HackBot is a dual-use cybersecurity tool. It is built for legitimate security professionals to perform authorized penetration testing, vulnerability assessments, and security research.

You are solely responsible for how you use HackBot.

Before using HackBot against any target, you MUST have:

HackBot must NOT be used for:

• 🚫 Unauthorized access to systems, networks, or data
• 🚫 Attacking targets without explicit written permission
• 🚫 Launching denial-of-service attacks against production systems
• 🚫 Exfiltrating sensitive data from systems you do not own
• 🚫 Creating, distributing, or deploying malware
• 🚫 Violating any local, national, or international laws

Violation of these terms may result in criminal prosecution. The HackBot developers assume no liability for misuse.

HackBot includes multiple layers of protection to prevent accidental damage and misuse.

1. Never commit API keys to version control — use environment variables or the config file
2. Restrict config permissions: chmod 600 ~/.config/hackbot/config.yaml
3. Rotate API keys regularly, especially after shared-machine usage
4. Use separate API keys for HackBot vs. production applications
5. Docker deployments: pass keys via -e flags, not Dockerfiles

• ❌ Does not send API keys to any server other than the configured AI provider
• ❌ Does not collect telemetry, analytics, or usage data
• ❌ Does not phone home or check for updates automatically
• ❌ Does not store credentials from target systems (intercepted creds appear only in session output)
• ❌ Does not exfiltrate any data from targets

HackBot includes a built-in intercepting proxy. When active:

• Proxy binds to 127.0.0.1 only (localhost) — not externally accessible
• Intercepted traffic is stored in memory only (not persisted to disk unless explicitly exported)
• Auto-detects and flags sensitive data patterns (credentials, API keys, tokens)
• Domain scoping restricts capture to specified domains

The active scanning engine makes real HTTP requests:

• All requests include a User-Agent: HackBot/2.0 ZeroDay-Scanner header for identification
• SSL certificate verification is disabled by default (pentest context: self-signed certs are common)
• Proxy support allows routing all traffic through Burp Suite or similar tools for inspection
• Request rate limiting and delay controls prevent accidental DoS

If you discover a security vulnerability in HackBot's code, please report it responsibly:

1. Do NOT open a public GitHub issue for security vulnerabilities
2. Include a detailed description with steps to reproduce
3. Provide any proof-of-concept code if applicable
4. Allow 90 days for the maintainer to develop and release a fix before public disclosure
5. Credit will be given to reporters in the release notes (unless anonymity is requested)

The following are in scope for security reports:

The following are out of scope:

┌─────────────────────────────────────────────────────┐
│                   HackBot Process                    │
│                                                      │
│  ┌──────────────┐   ┌────────────────────────────┐  │
│  │  AI Engine   │   │    Tool Runner              │  │
│  │  (LLM calls) │──▶│  • Command validation      │  │
│  │              │   │  • Blocked command check    │  │
│  │  Generates   │   │  • Allowlist enforcement    │  │
│  │  action JSON │   │  • Safe mode checks        │  │
│  └──────────────┘   │  • User confirmation       │  │
│                      │           │                 │  │
│                      │           ▼                 │  │
│                      │  ┌────────────────────┐    │  │
│                      │  │ subprocess.Popen   │    │  │
│                      │  │ • Sanitized env    │    │  │
│                      │  │ • Timeout enforced │    │  │
│                      │  │ • Output capped    │    │  │
│                      │  └────────────────────┘    │  │
│                      └────────────────────────────┘  │
└─────────────────────────────────────────────────────┘

1. Pin your dependencies: Use pip freeze > requirements.txt in production
2. Run in a virtual environment: Isolate HackBot from system Python
3. Use Docker for maximum isolation in shared environments
4. Audit plugins: Third-party plugins execute arbitrary code — review before installing
5. Keep updated: Run pip install --upgrade regularly to get security patches

HackBot is released under the MIT License.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND. The authors and contributors are not responsible for any damage, legal consequences, or misuse arising from the use of this software.

By using HackBot, you agree to:

• Use it only for authorized security testing
• Comply with all applicable laws and regulations
• Accept full responsibility for your actions

Last updated: April 2026 — HackBot v1.2.3