ReconForge is a dual-use security tool. Both the platform itself and the data it holds (BYO API keys, attack-surface data about third-party orgs) are high-value targets. We take security defects seriously.

Do not open a public issue for security vulnerabilities.

Instead, report privately via GitHub Security Advisories ("Report a vulnerability") or email security@reconforge.dev (PGP key in /.well-known/security.txt, to be published at first release).

Please include:

• A description of the issue and its impact.
• Steps to reproduce (a minimal PoC if possible).
• Affected version / commit.

• Acknowledgement within 72 hours.
• Triage and severity assessment within 7 days.
• Coordinated disclosure: we aim to ship a fix before public disclosure and will credit reporters who wish to be named.

Because ReconForge enforces authorization for active scanning, the following classes are treated as Critical by default:

1. Scope/authorization bypass — any input that causes an out-of-scope or hard-blocked target to be classified as in-scope and active-probing-allowed (a "false-allow"). The Scope Engine maintains a zero false-allow invariant.
2. Broken object-level authorization (BOLA/IDOR) — any cross-tenant or cross-user data access.
3. Command/argument injection into tool adapters leading to worker code execution.
4. Secret disclosure — any path that exposes BYO API keys (logs, errors, raw output, API responses).
5. SSRF / egress escape — reaching cloud metadata, link-local, or private ranges from a worker.

Pre-1.0 software. Until the first stable release, only the latest main is supported. A third-party penetration test gating 1.0 GA is a project requirement (zero Critical/High findings).

Good-faith security research on your own ReconForge instance is welcome and will not be pursued legally. Do not test instances you do not own or operate.