Security and Ethics

Security and Ethics

OSINT Forge is for lawful, authorized research. Public availability of data does not eliminate privacy, contractual, ethical, or authorization obligations.

Authorization

• Document purpose and authorization scope before starting a case.
• Scan networks only when you own them or have explicit permission.
• Respect law, contracts, service terms, rate limits, and organizational policy.
• Use restrained defaults and concurrency.
• Stop when scope is unclear or authorization expires.

Data handling

• Never commit targets, credentials, cookies, tokens, case data, or investigation results.
• Store raw evidence separately from interpretation.
• Treat tool output, correlations, and confidence scores as leads until reviewed.
• Preserve provenance when normalizing or deduplicating values.
• Protect parent directories, backups, copied reports, and exports.
• Redact sensitive material before sharing.
• Use synthetic, non-sensitive data in tests and bug reports.
• Never supply credentials, private communications, personal information, case data, investigation results, or non-public vulnerability details to an AI.

OSINT Forge creates its own state, case, and batch artifacts with owner-only permissions. Upstream tools may create additional files under their own behavior.

Recursive discovery safeguards

Controlled recursive discovery is committed for v0.9 and is not present in the stable v0.8.0 release. Stable v0.8 performs only explicitly selected provider execution or offline ingestion and deterministic intelligence derivation; it does not automatically pursue discovered entities. It must not become an unbounded crawler. Before v1.0 it must include:

• explicit case authorization and opt-in execution;
• eligible entity and plugin allowlists;
• depth, request, concurrency, and elapsed-time budgets;
• deterministic loop and duplicate-work prevention;
• domain, network, service, and policy scope checks;
• preview and human-approval controls where risk warrants them;
• complete records of why each derived entity was scheduled or rejected; and
• a reliable stop mechanism with resumable state.

No confidence score or tool assertion may silently expand legal authorization. Human review remains the boundary between an automated lead and a verified fact.

AI access

LizardPope1101 is the only person authorized to connect an AI system to the repository, GitHub account, or repository-integrated tooling. Connected AI receives only access needed for the authorized task. Contributors may use disconnected AI assistance with selected non-sensitive material but may not grant direct repository access. See AI Development Policy.

Operational safeguards

Adapters use argument arrays rather than interpolated shell strings. Plugin and case paths are validated. Case IDs, symlinks, traversal attempts, malformed schemas, report destinations, and reserved artifacts are checked. Lifecycle scripts cannot escape their plugin directories.

Vulnerabilities

Do not disclose a suspected vulnerability in a public issue, pull request, discussion, wiki page, log, or case report. Use GitHub private vulnerability reporting and follow the repository Security Policy.