StealthPrivesc is an authorized-assessment tool. It is intended for use only against systems the operator is explicitly authorized to test. Please read this document before reporting a vulnerability or requesting new capabilities.

Only the most recent tagged release on the main branch is supported. The current version is declared in pyproject.toml and asserted by the CI operator-contract job.

Please report suspected vulnerabilities privately by email to:

rikter.skale@gmail.com

Include, where practical:

• A clear description of the issue and the affected component (file, function, CLI flag, or workflow).
• Steps to reproduce, including OS, Python version, and any relevant configuration.
• The impact you believe the issue has (data exposure, unauthorized action, supply-chain risk, etc.).
• Whether the issue is exploitable against a default configuration or only under a specific configuration.

The project target is to acknowledge new reports within 7 days and to provide a remediation plan within 30 days. Coordinated disclosure timelines are negotiated with the reporter. These are response targets, not a service-level agreement; repository contents alone cannot evidence that a specific report has been received or acknowledged.

Please do not open a public GitHub issue for a suspected vulnerability.

In-scope classes of issue:

• Command injection, path traversal, or unsafe subprocess handling in the CLI, skills, loaders, or OPSEC helpers.
• Authorization-gate bypasses (core/auth.py, --issue-token, --auth-token).
• Report generation issues that could exfiltrate data (network calls, embedded telemetry, secrets in reports).
• Supply-chain issues in the build (scripts/normalize_sdist.py, .github/workflows/*).

Out of scope:

• Findings against a target system that were produced by an authorized assessment - those are the operator's responsibility to triage.
• Requests for additional offensive capability. This project deliberately keeps aggressive execution paths behind an authorization gate and does not ship exploit payloads.

By using StealthPrivesc you accept the safety posture in the README:

• Safe mode is the default.
• Aggressive-scope skills are blocked until a signed, time-bound authorization token is supplied.
• The audit trail (.stealthprivesc/history, .stealthprivesc/reviews.json) is intended to be preserved when working under an engagement.

Do not use StealthPrivesc on systems you do not have written authorization to assess.