Security and Responsible Use

Security and Responsible Use

Authorized Use Only

Use Lophiarch only against systems you own or are explicitly authorized to assess. Authorization should define the targets, techniques, time window, intensity, data handling, and reporting expectations.

Public accessibility is not authorization.

Operational Risks

Docker Socket

The current deployment mounts /var/run/docker.sock. Access to this socket is effectively privileged because a process may create containers with powerful host access.

Recommended controls:

• Run Lophiarch on a dedicated host or isolated worker node.
• Restrict who can interact with the Telegram bot.
• Do not expose the Docker API over an unauthenticated network endpoint.
• Monitor container creation and image changes.
• Pin and verify production images.
• Rotate secrets if the host or bot is compromised.

Secrets

Protect:

• TELEGRAM_BOT_TOKEN
• AI_API_KEY or any provider-specific compatibility credential
• Telegram chat identifiers where sensitive
• Scan reports and raw findings

Do not place secrets in Git, issue forms, pull requests, screenshots, or logs. Use development-only credentials for testing. A local provider can reduce third-party prompt exposure, but its endpoint and host must still be protected. If a hosted provider is selected, review its retention, logging, and data-use policies before sending sensitive assessment context.

Target Data

Scan output can reveal services, endpoints, software versions, and vulnerabilities. Treat results as confidential security data. Define retention and deletion procedures appropriate to the assessment.

Scanner Intensity

• Nmap deep mode scans all ports and uses default scripts.
• Ffuf may generate substantial request volume.
• Nuclei behavior depends on enabled templates.
• Repeated subdomain resolution can affect external services.

Select the least intrusive mode that meets the authorized objective.

Reporting Lophiarch Vulnerabilities

Do not open a public issue for a suspected vulnerability in Lophiarch.

Follow the repository Security Policy. Use GitHub private vulnerability reporting when available or the fallback private contact documented in that policy.

Vulnerabilities found in a third-party target are not Lophiarch vulnerabilities and must follow the target owner's disclosure process.

Contribution Boundaries

Contributions must not add:

• Credential theft or secret exfiltration.
• Unauthorized persistence or access.
• Destructive payloads.
• Evasion designed to facilitate abuse.
• Hidden network activity.
• Unsafe command construction.

Security-sensitive changes should explain their trust boundaries, permissions, inputs, network behavior, and validation strategy.

No Bug Bounty

The project security policy does not establish a bug-bounty program or promise financial compensation.