Skip to content

Repository navigation

Security: Masriyan/Waduh

Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

Version Supported
4.x ✅
3.x ✅ (maintenance only)
2.x ❌
1.x ❌

Authorized Use Only

⚠️ IMPORTANT LEGAL NOTICE

W.A.D.U.H. Scanner is designed exclusively for authorized security testing and research purposes.

You MUST:

  • Have explicit written permission from the system owner before scanning any target
  • Operate within the scope of your authorization
  • Follow responsible disclosure practices
  • Comply with all applicable local, national, and international laws

You MUST NOT:

  • Scan systems without authorization
  • Exploit vulnerabilities on production systems
  • Use this tool for malicious purposes
  • Share or publish sensitive findings without permission

AI Data Handling

WADUH v4.0 includes AI-powered analysis. When using cloud AI providers:

  • Local AI (Ollama/LM Studio): No data leaves your machine. Recommended for sensitive engagements.
  • Cloud AI (OpenAI/Anthropic/Groq): Target-identifying information (IPs, URLs, emails, API keys) is automatically sanitized before submission. However, vulnerability details are sent for analysis.
  • Recommendation: Use --ai-provider ollama for maximum OPSEC, or --no-ai to disable AI entirely.

Reporting Security Vulnerabilities

If you discover a security vulnerability in W.A.D.U.H. Scanner itself:

  1. Do NOT open a public GitHub issue
  2. Email the maintainers at: security@example.com (replace with actual email)
  3. Include:
    • Description of the vulnerability
    • Steps to reproduce
    • Potential impact
    • Any suggested remediation

We will acknowledge receipt within 48 hours and provide a detailed response within 7 days.

Responsible Disclosure

If you use W.A.D.U.H. to discover vulnerabilities in WordPress sites:

  1. Report to the site owner before any public disclosure
  2. Allow reasonable time (90 days recommended) for remediation
  3. Coordinate disclosure with the affected party
  4. Never exploit vulnerabilities for personal gain

Legal Disclaimer

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND. THE AUTHORS 
ASSUME NO LIABILITY FOR MISUSE OF THIS TOOL. USERS ARE SOLELY RESPONSIBLE 
FOR ENSURING THEY HAVE PROPER AUTHORIZATION BEFORE SCANNING ANY SYSTEMS.

UNAUTHORIZED ACCESS TO COMPUTER SYSTEMS IS ILLEGAL UNDER:
- Computer Fraud and Abuse Act (CFAA) - United States
- Computer Misuse Act - United Kingdom
- Cybercrime laws in virtually every country

VIOLATION OF THESE LAWS CAN RESULT IN CRIMINAL PROSECUTION AND CIVIL LIABILITY.

Attribution

When publishing research or reports based on W.A.D.U.H. findings, please cite:

W.A.D.U.H. Scanner v4.0 Phantom Edition - WordPress Analysis & Debugging Utility Helper
https://github.com/Masriyan/Waduh

There aren't any published security advisories