Do not open a public GitHub issue for security vulnerabilities.

Email: security@open-re.org

Or use GitHub Security Advisories (preferred):

1. Go to the repository's Security tab
2. Click Report a vulnerability
3. Fill in the details

• Description of the vulnerability
• Steps to reproduce
• Affected versions (e.g., openre-scan 0.1.0)
• Potential impact
• Suggested fix or mitigation (if known)
• Your contact info for follow-up

We will credit you in the security advisory (unless you request anonymity).

openre-scan is a network security scanner that:

• Makes HTTP/HTTPS requests to user-specified targets
• Parses HTTP responses and HTML content
• Does not execute code from targets
• Does not follow redirects by default (configurable)
• Enforces timeouts and redirect limits

• No code execution from scanned targets
• No Shell commands — pure Rust HTTP client
• Memory safe — no unsafe in scanner code
• No telemetry — zero network calls except to target
• No auto-update — user controls binary replacement
• Path traversal prevention — output paths resolved safely

Only scan targets you own or have explicit written permission to test.

Unauthorized scanning may violate:

• Computer Fraud and Abuse Act (US)
• Computer Misuse Act (UK)
• GDPR (EU)
• Terms of service of hosting providers

# Default: no redirects, 10s timeout, 10 max redirects
openre-scan scan https://example.com

# Explicit limits for untrusted targets
openre-scan scan https://target.com --timeout 5 --max-redirects 0

For scanning untrusted targets in production:

# Run in network namespace (Linux)
sudo ip netns add scan-ns
sudo ip netns exec scan-ns openre-scan scan https://target.com

# Or use Docker with restricted network
Docker run --rm --network none \
  -v $(pwd):/data \
  ghcr.io/rxven-1907/openre-scan:latest \
  scan https://target.com --output /data/results.sarif

• GitHub Dependabot — weekly dependency updates
• Cargo-audit — runs in CI on every PR
• Cargo-deny — license and maintenance checks

Note: The core scanner (openre-scan) does not directly depend on sqlx, wasmtime, or axum — those are in optional platform crates. Vulnerabilities in those crates do not affect the shipped binary.

# Check for vulnerabilities
Cargo audit

# Update dependencies
Cargo update
Cargo audit  # Verify fixes

Each release includes SHA256 checksums:

# Verify download
sha256sum -C openre-scan-Linux-x86_64.sha256

• Built on GitHub Actions (ephemeral runners)
• No external build dependencies
• Static linking — no runtime library loading
• Reproducible builds via locked Cargo.lock

• Security Email: security@open-re.org
• GitHub Security Advisories: Report here
• PGP Key: Available on request

Last updated: 2026-08-16 for v0.1.0 release