Security and disclosure
AdminKit checks other people's exposure for a living, so we hold ourselves to the same rules we ask of the devices and services we check.
-
Active scanning of a third-party asset only starts after its owner verifies control, by DNS TXT record, file upload, or OAuth with GitHub or a package registry. Until verified, only passive or lightweight, rate-limited checks run — never exploitation.
-
We do not publish specific vulnerabilities found in a third party's assets. Public pages show aggregate scores or anonymised data; detail goes only to the verified owner.
-
An Acceptable Use Policy governs every tool and API, with an abuse channel to report misuse.
-
Our honeypots are low-interaction only: they do not attack back and do not relay malicious traffic anywhere.
-
Customer data is isolated per tenant and encrypted at rest, with key rotation and a Data Processing Agreement for GDPR-covered customers.
-
AdminKit has published a security.txt and a vulnerability disclosure channel ([email protected]) from day one.
Report a vulnerability
Email [email protected] with what you found and, if you have one, a way to reproduce it. The machine-readable contact is published at /.well-known/security.txt.
Misuse of AdminKit's own tools or infrastructure? Report it to [email protected] instead. See Acceptable Use.
Frequently asked questions
How do I report a vulnerability in AdminKit itself?
Email [email protected] with details and, if possible, steps to reproduce. See /.well-known/security.txt for the machine-readable version of this contact.
Do you offer a bug bounty?
Not yet — we do not have a paid bug bounty program at this stage. We still want to hear about vulnerabilities and will acknowledge valid reports.
Will you scan my network without permission?
No. Active scanning of a third-party asset only happens after the owner verifies control of it. The public tools only ever check the IP address or domain you submit, from the outside, the same way any visitor could.