PentestAI is an open-source project under active development.
Security fixes are applied to the latest released version and the main branch.

PentestAI is an AI-assisted penetration testing framework designed to support authorized security testing only.

The tool is intended to:

• Assist with reconnaissance, attack surface analysis, vulnerability scanning, validation, and reporting
• Analyze outputs from existing security tools
• Help security professionals reason about findings and risks
• Automate reporting and documentation

PentestAI is not intended to:

• Perform unauthorized access
• Automatically exploit systems without explicit permission
• Be used against targets outside the user's legal scope

Users are solely responsible for ensuring they have explicit authorization to test any target.

PentestAI follows a safe-by-default philosophy:

• Default mode avoids destructive or intrusive actions
• No automatic exploitation or weaponized payload generation
• AI components provide analysis, reasoning, and guidance — not autonomous attacks
• Scope allowlists are enforced to prevent accidental out-of-scope testing
• Human-in-the-loop is expected for sensitive testing decisions

Any unsafe or advanced testing must be explicitly enabled by the user and performed only in permitted environments (e.g., labs, staging systems, or authorized production tests).

If you discover a security vulnerability in PentestAI itself, please report it responsibly.

• Do not open a public GitHub issue for security vulnerabilities
• Send a detailed report via email to:

[dinhlnng2003@gmail.com](mailto:dinhlnng2003@gmail.com)

(If this address is not yet active, use the repository owner's contact information.)

Please include:

• A clear description of the vulnerability
• Steps to reproduce (if applicable)
• Potential impact
• Affected versions or commit hashes
• Any suggested remediation (optional)

1. Report is received and acknowledged
2. Maintainers assess severity and impact
3. Fix is developed and tested
4. A security patch or release is published
5. Public disclosure may follow after a fix is available

We aim to respond to valid reports within 7 days.

PentestAI depends on third-party tools and AI providers.

• Users are responsible for keeping external tools (nmap, nuclei, httpx, etc.) up to date
• API keys must be stored securely (e.g., environment variables)
• Secrets must never be committed to the repository
• CI checks should be enabled for dependency updates when possible

When using AI providers:

• Scan results and artifacts may be sent to external AI APIs
• Users are responsible for complying with their organization's data handling policies
• Avoid sending sensitive production data unless explicitly approved
• Review provider terms of service and data retention policies

PentestAI does not store or transmit API keys beyond runtime usage.

We strongly encourage responsible disclosure and ethical use.

If you are unsure whether a finding relates to PentestAI or a tested target, please contact the maintainers before publishing details.

PentestAI is provided "as is", without warranty of any kind.

The maintainers are not responsible for:

• Misuse of the tool
• Illegal or unethical testing activities
• Damages resulting from improper configuration or use

By using PentestAI, you agree to use it responsibly and in compliance with applicable laws and regulations.

We appreciate the security community and contributors who help improve PentestAI through responsible research and reporting.