Security starts with honest boundaries.
Mallace’s testing boundaries, known limitations, and evidence-handling approach.
Explicit authorization
Only test systems you are authorized to assess, within a defined scope and operating window. A configured endpoint or a self-issued campaign token does not establish ownership or permission.
Prototype limitations
The current API lacks production authentication and access control. Durable recovery, independent target authorization, network destination policy, target credential management, and reviewed evaluation benchmarks remain open.
Sensitive evidence
Attack payloads and target responses can contain secrets or private information. Keep local outputs protected and review them before export. Do not submit credentials through this informational website.
Report an issue
No public security contact or disclosure program has been configured for this preview yet. Coordinate directly with the project operator through your existing trusted channel. A monitored disclosure route still needs to be defined.