Please do not open a public issue for a vulnerability in nullbyte-security.

Report it privately through GitHub Security Advisories:

https://github.com/Eliahhango/nullbyte-security/security/advisories/new

Include the affected version, a description of the issue, and reproduction steps or a proof of concept. You will get an acknowledgement as soon as possible, and credit in the advisory if you want it.

This policy covers the plugin, its installer and the code in this repository. It does not cover the host NullByte CLI or third-party scanners invoked by the adapters; report those to their respective projects.

nullbyte-security is for authorized testing only. Point it at systems you own or have written permission to test. Reports and evidence can contain live credentials; treat every engagement directory as credential-grade sensitive.