We take the security of Endpointo seriously. If you discover a security vulnerability, please follow these steps:

Please do not open a public GitHub issue for security vulnerabilities. This helps protect users who may be using vulnerable versions.

Send details of the vulnerability to: [ismailtasdelen@gmail.com]

Include in your report:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if available)

• Initial Response: Within 48 hours
• Status Update: Within 7 days
• Fix Timeline: Depends on severity (critical issues prioritized)

1. We acknowledge receipt of your vulnerability report
2. We confirm the vulnerability and determine its severity
3. We develop and test a fix
4. We release a patched version
5. We publicly disclose the vulnerability (with credit to reporter, if desired)

When using Endpointo, follow these security guidelines:

Always use appropriate rate limiting to avoid overwhelming target servers:

# Use moderate rate limits (default is 10 req/s)
endpointo scan -u https://target.com -r 10

Endpointo respects robots.txt by default. Do not disable this unless you have explicit permission:

# robots.txt compliance is enabled by default
endpointo scan -u https://target.com

Only scan:

• Your own applications
• Applications where you have written permission
• Bug bounty programs within their scope

Endpointo enforces TLS certificate verification. This cannot be disabled, ensuring secure connections.

When using Python plugins:

• Only use plugins from trusted sources
• Review plugin code before execution
• Be aware plugins have access to scan data

Endpointo may extract endpoints containing sensitive information:

• Store output files securely
• Do not commit endpoints.json to public repositories
• Redact sensitive data before sharing

Endpointo's attack surface includes:

1. HTTP Client: Uses reqwest for HTTP operations

   • Mitigation: Keep dependencies updated, enforce TLS verification

2. Regex Engine: Uses regex crate for pattern matching

   • Mitigation: Patterns are pre-compiled and tested for ReDoS

3. Python FFI (optional): PyO3 bridge for plugins

   • Mitigation: Plugin feature is optional and isolated

4. File I/O: Reads JavaScript files from disk

   • Mitigation: Validates file paths and handles errors gracefully

5. Output Serialization: JSON/YAML/XML/HTML generation

   • Mitigation: Uses well-maintained serialization crates, escapes output

Endpointo includes built-in protections against accidental DoS:

• Rate limiting (default: 10 req/s)
• Concurrent request limits (default: 10)
• Request timeouts (default: 30s)
• Exponential backoff on errors

We use the following severity levels:

• Critical: Remote code execution, authentication bypass
• High: Significant data exposure, privilege escalation
• Medium: Moderate data exposure, DoS vulnerabilities
• Low: Minor information disclosure, configuration issues

Security patches are released as soon as possible after verification. Users are notified via:

• GitHub Security Advisories
• Release notes
• Project README

We believe in responsible disclosure and will:

• Work with reporters to understand and fix issues
• Provide credit to reporters (unless they prefer anonymity)
• Coordinate disclosure timing to protect users
• Issue CVEs for significant vulnerabilities

Security testing should only be performed on:

1. Systems you own
2. Systems where you have explicit written permission
3. Bug bounty programs within their defined scope

Unauthorized security testing may be illegal in your jurisdiction.

For security-related questions or concerns:

• Email: ismailtasdelen@gmail.com
• GitHub: @ismailtsdln

Thank you for helping keep Endpointo and its users safe!