Currently supported versions for security updates:

METL is designed exclusively for:

• Malware research
• Security analysis and testing
• Educational purposes
• Authorized penetration testing

This tool must NOT be used for:

• Creating or distributing actual malware
• Unauthorized access to systems
• Circumventing security measures without permission
• Any illegal activities

We take the security of METL seriously. If you discover a security vulnerability, please follow these guidelines:

• Security vulnerabilities in the library code
• Potential for misuse or abuse
• Dependency vulnerabilities
• Documentation that could facilitate malicious use

1. DO NOT open a public GitHub issue for security vulnerabilities
2. Email the maintainer directly at: [Your security email - needs to be added]
3. Provide as much detail as possible:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested remediation (if any)

• Acknowledgment: Within 48 hours of report
• Initial Assessment: Within 7 days
• Status Update: Every 7 days until resolution
• Resolution: Critical issues within 30 days, others as soon as practical

• We practice responsible disclosure
• Security advisories will be published after a fix is available
• You will be credited for the discovery (unless you prefer anonymity)
• We ask for 90 days before public disclosure

1. Isolated Environment: Always test in isolated VMs or containers
2. No Production Systems: Never test on production or sensitive systems
3. Network Isolation: Use air-gapped or isolated networks
4. Proper Disposal: Securely wipe test environments after use

// Good: Validate and sanitize inputs
public byte[] ProcessInput(byte[] input)
{
    if (input == null || input.Length == 0)
    {
        throw new ArgumentException("Input cannot be null or empty");
    }

    // Process safely
}

// Bad: No validation
public byte[] ProcessInput(byte[] input)
{
    // Directly processing untrusted input
}

• Always require explicit user authorization before executing operations
• Log all operations for audit purposes
• Implement rate limiting for API operations
• Use proper error handling to avoid information disclosure

• Keep all dependencies up to date
• Monitor for security advisories
• Use dotnet list package --vulnerable regularly
• Enable Dependabot or similar automated dependency scanning

# Check for vulnerable packages
dotnet list package --vulnerable

# Update packages
dotnet outdated

METL uses the .NET CLI to compile code, which:

• Executes external processes
• Requires appropriate system permissions
• Could be exploited if source code is not validated

Mitigation: Always validate and sanitize source code before compilation.

Operations require file system access for:

• Reading source files
• Writing compiled binaries
• Accessing embedded resources

Mitigation: Implement proper path validation and use least-privilege principles.

The library manipulates binary executables which:

• Could be detected as malware by AV/EDR
• Requires careful handling to avoid corruption
• Should only be performed in controlled environments

Mitigation: Use in isolated test environments only.

We perform regular security assessments including:

• Static code analysis using Microsoft.CodeAnalysis.NetAnalyzers
• Dependency vulnerability scanning
• Code reviews for security implications
• Penetration testing of the library itself

Our CI/CD pipeline includes:

• CodeQL analysis
• Dependency vulnerability scanning
• SAST (Static Application Security Testing)
• License compliance checking

This tool may be subject to export control regulations. Users must comply with:

• Export Administration Regulations (EAR)
• International Traffic in Arms Regulations (ITAR)
• Computer Fraud and Abuse Act (CFAA)

Users must comply with local laws regarding:

• Computer security research
• Cryptography
• Export controls
• Cybersecurity testing

If METL is misused or involved in a security incident:

1. Document: Collect all relevant information
2. Report: Contact the maintainers immediately
3. Cooperate: Work with law enforcement if required
4. Learn: Help us improve to prevent future incidents

For security concerns:

• Security Issues: [Your security email]
• General Issues: GitHub Issues
• Maintainer: Jarred Capellman

We thank the security research community for helping keep METL secure and ethical.

Contributors who have helped improve METL's security:

• Your name could be here!

Remember: With great power comes great responsibility. Use METL ethically and legally.

Last Updated: 2025