Tezcat is an offensive security tool that stores credentials for the AI endpoints it probes, so vulnerabilities in Tezcat itself are taken seriously.

Security fixes are applied to the latest released version. There is no long-term support for older tags; upgrade to the current release before reporting an issue where possible.

Please report security issues privately, not through a public GitHub issue or pull request.

• Email piraveen@live.nl with a description of the issue, the affected component, and reproduction steps or a proof of concept.
• If you can, include the version (VERSION.txt) and your deployment overlay (dev or prod) so the issue can be reproduced quickly.

Please give a reasonable window to investigate and ship a fix before any public disclosure. Coordinated disclosure is appreciated, and credit will be given to reporters who want it.

In scope:

• Credential confidentiality (the encrypted store, the gated decryption path, and the guarantee that plaintext is never returned by any API surface).
• The append-only audit log invariant.
• Authentication, RBAC, MFA, and account-lockout behaviour.
• Injection, SSRF, and similar flaws in the API or the probe orchestrator.

Out of scope:

• Findings that require host-root access or a malicious operator. Tezcat is single-tenant and assumes a trusted operator team on a network you control (see ADR 0006).
• The behaviour of the third-party AI endpoints you point Tezcat at. Only probe endpoints you own or are authorised to test.
• Use of documented development defaults (for example the devpw database password) in a production deployment. Rotate every secret as described in the README before exposing an instance.