This policy covers Admin Panel Finder (this GitHub repository), not third-party websites you might scan.

Repository: github.com/rootbytex/admin-panel-finder
Owner: rootbytex

There is no paid support channel. Fixes land on main.

Admin Panel Finder is an admin panel finder / login page finder for authorized recon.

It uses GET and HEAD only. It is meant to find surfaces such as wp-admin, cPanel, Plesk, phpMyAdmin, and other CMS/hosting logins on in-scope hosts.

It does not:

• brute-force or spray credentials
• bypass 403, WAF, or authentication
• send exploits, payloads, or shells
• probe hosts that the scope engine rejects

If you need an attack framework, this project is the wrong place.

You may run the scanner only against:

• systems you own, or
• systems a written bug-bounty / pentest engagement puts in scope

Out-of-scope hostnames are written to out_of_scope.txt and are not HTTP-probed.

Using this software against systems you are not allowed to test is your responsibility and may be illegal. The authors do not condone that use.

Report problems in the tool itself, for example:

• path traversal in the GitHub zip updater
• unexpected files written outside the project directory
• secrets committed in the repo
• a logic bug that would make the scanner hit out-of-scope hosts

1. Prefer a private GitHub Security Advisory on this repository (Security tab → Advisories), if you have access.
2. Otherwise open a GitHub issue and mark it as a tool security concern:
   https://github.com/rootbytex/admin-panel-finder/issues
   Do not attach a public exploit against live third-party sites.

• Affected version or commit
• OS (Windows / Linux / macOS / Termux) and Python version
• Steps that stay on your machine or a lab you own
• Impact (who is hurt, what is overwritten, what leaks)

• Passwords, cookies, API keys, session dumps
• Customer or private target URLs (use example.com)
• Full exploit chains against unrelated software

You should get an acknowledgement when someone sees the report. There is no bug-bounty program for this repo unless the owner announces one.

Please give the maintainer reasonable time to ship a fix on main before publishing a detailed write-up of a tool vulnerability. Do not use this repo to dump 0-days in unrelated products.