NekomataC2 is an offensive security framework intended for authorized security testing and red team operations only. This policy covers vulnerabilities in the framework itself (team server, GUI client, beacon generation tooling) — for example authentication bypass, remote code execution in the server or client, secret leakage, or unsafe defaults.

It does not cover the fact that beacons can be detected by security products; that is expected behavior for a C2 framework.

Please do not open public GitHub issues for security vulnerabilities.

Report vulnerabilities privately through GitHub Private Vulnerability Reporting (the "Security" tab → "Report a vulnerability") on this repository.

Please include:

• A description of the vulnerability and its impact
• Affected component and version/commit
• Steps to reproduce or a proof of concept
• Any suggested mitigation, if you have one

You can expect an acknowledgment within 7 days and a status update within 30 days. If the report is accepted, a fix will be developed privately and released before public disclosure, crediting the reporter (unless you prefer to remain anonymous).

Only the latest commit on the default branch receives security fixes. There are no maintained release branches yet.

• The team server requires ADMIN_PASSWORD and NEKOMATA_SECRET_KEY environment variables and refuses to start with insecure defaults.
• Never commit config.json, certificates (certs/), or databases (*.db) — they are gitignored; keep them that way.
• Self-signed certificates generated by generate_certs.py are for lab use. Use proper certificates for production deployments.
• Third-party BOF collections under nekomata_c2_beacon/windows/ have their own maintainers — report vulnerabilities in those components upstream (see NOTICE).