Security Philosophy

A tool that automates reconnaissance and exploitation has to take its own safety seriously. Here's how Hollowpath actually does that — not as a policy document, as code.

Discovered is not the same as authorized

Hollowpath’s scope engine draws a hard line between three different things: a target being discovered by a scan, a target being in scope, and a target being authorized for active action. Finding something doesn’t put it in scope. Being in scope doesn’t authorize firing anything at it. The default is deny — if scope can’t be positively confirmed, the target is treated as unauthorized, full stop.

Scope matching is deliberately strict

A wildcard like *.example.com matches real subdomains only — never the apex domain itself.
Matching is label-based, not a naive string suffix check — evil-example.com will never match *.example.com, a mistake a simple .endswith() check would make.
A hostname being in scope does not automatically put the IP address it resolves to in scope — shared hosting means that IP could serve other domains that aren’t authorized.
IPv6 is explicitly rejected as invalid rather than silently mishandled by a parser that wasn’t built for it.

Enforcement happens at the engine, not the UI

The scope engine gates every actual execution boundary directly — starting external reconnaissance tooling against an out-of-scope target, filtering discovered hosts before they’re acted on, and downloading or firing an exploit. That last one is the hard rule: nothing downloads or executes against an out-of-scope target, regardless of what a confirmation dialog shows. The GUI presents information; it is never the thing actually keeping an action from happening.

Exploitation requires explicit, multi-step confirmation

There is no single generic “exploit” button anywhere in Hollowpath. Acting on an exploit candidate requires the operator to explicitly confirm the actual resolved target — not a placeholder value shown before confirmation and swapped afterward — before anything runs.

Known, documented limits

Honesty about limits is part of this philosophy, not a deviation from it. Hollowpath’s scope engine cannot currently stop a third-party tool’s own internal crawling behavior from touching out-of-scope hosts during that tool’s own execution — that would require controlling that tool’s own scope flags directly, which is a known, explicitly out-of-scope gap for the current milestone rather than an unnoticed one.