Please do not report security issues through public GitHub issues.

Use GitHub's private vulnerability reporting instead:

👉 Report a vulnerability

Include as much of the following as you can:

• The type of issue and where in the codebase it occurs
• Steps to reproduce, ideally with a minimal input file
• The impact — what an attacker gains
• Any suggested fix

You can expect an acknowledgement within a few days. We'll keep you updated as we work on a fix and will credit you in the advisory unless you'd rather stay anonymous.

SigCraft is at v0 and pre-release. Only the main branch receives fixes; there are no maintained release branches yet.

SigCraft parses untrusted input — advisory text, patch diffs, and rule files pulled from third parties. Issues in that handling are in scope. Things worth reporting:

• Parser exploitation — crafted diffs or rule files that cause unbounded memory or CPU use (catastrophic regex backtracking in the extractor is the most plausible instance), crashes, or unexpected code execution
• Path traversal on emit — a crafted advisory identifier escaping the --out directory
• Command injection through the nuclei / yara subprocess invocations
• Credential leakage — ANTHROPIC_API_KEY, NVD_API_KEY, or GITHUB_TOKEN appearing in output, emitted rule headers, error messages, or logs
• Server-side request forgery via ingest URLs

• A generated rule being wrong. False positives and false negatives in candidate rules are expected — that's why every rule ships as an UNREVIEWED CANDIDATE and why the validator reports what it can't verify. File those as normal issues; they're valuable, but they aren't vulnerabilities.
• Rate limits or availability of NVD, GitHub, or the Anthropic API.
• Vulnerabilities in the CVEs being analyzed. Report those to the affected vendor, not here.

SigCraft produces detection rules. Please only run generated templates against systems you are authorized to test — Nuclei templates make live requests, and "it was machine-generated" is not authorization.

Contributions that convert candidate detections into working exploit chains, or that aim to evade detection rather than produce it, are out of scope. See the Code of Conduct for where that line sits.