If you discover a security vulnerability in AdPentestAI-Python, please do not open a public issue. Instead, email security details to nsh531@gmail.com with:

1. Description of the vulnerability
2. Steps to reproduce (if applicable)
3. Potential impact
4. Suggested fix (if you have one)

Response Timeline:

• Acknowledgment within 48 hours
• Initial assessment within 1 week
• Security patch release within 2 weeks for critical issues

• --scope-confirmed flag required — Framework requires explicit authorization before tool execution
• Dry-run mode enabled by default — No tools execute without explicit activation
• No credentials stored — All credential testing is transient
• No plaintext logging — Credentials never written to logs or output

• All tool commands validated before execution
• Subprocess timeouts prevent hanging processes
• Error handling catches and logs exceptions
• No shell injection (command arrays, no shell=True)

• DNS fallback chain prevents DNS spoofing attacks
• TLS/SSL support for email protocols (port 465, 587, 993, 995)
• Socket timeouts prevent infinite hangs
• Connection errors handled gracefully

• Anonymous bind only (no credential transmission)
• RootDSE queries read-only
• No modification of directory objects
• Timeout on unresponsive servers

1. Run in authorized environment only

   • Obtain written authorization before scanning
   • Use --scope-confirmed to confirm authorization awareness

2. Run on isolated network

   • Test in lab before production use
   • Monitor network impact of parallel scanning

3. Secure credential testing

   • Use test credentials, not real passwords
   • Review output before sharing
   • Don't commit output to version control

4. Monitor resource usage

   • ThreadPoolExecutor uses up to 32 workers
   • Monitor CPU/memory during execution
   • Adjust timeouts for slow networks

• No hardcoded credentials in code
• No plaintext passwords in output
• Subprocess calls use command arrays (no shell)
• Timeouts on all network operations
• Error messages don't leak sensitive info
• Scope validation before tool execution
• TLS/SSL for encrypted protocols
• Input validation on user arguments

• No authentication — Only anonymous/null session enumeration
• No encryption — Plain SMTP (port 25) supported for VRFY/RCPT commands
• Local privilege escalation not tested — Framework assumes network access only
• No persistence — Results not stored persistently (JSON output only)

If you find vulnerabilities in dependencies (dnspython, ldap3, httpx), please:

1. Report to the dependency maintainers first
2. Notify us via security email with details
3. We'll update dependencies once patches available

For security questions or concerns, contact: nsh531@gmail.com