Report a security problem

If you find a security problem in srvscripts.com, in one of our scripts or in one of our online tools, please tell us privately first, so we can fix it before anyone can misuse it.

How to report it

• E-mail security@srvscripts.com (the address in our security.txt), or use the contact form with “Security” in the subject.
• Say what is affected: the page or tool URL, or the script name and version.
• Give the steps to reproduce it and what an attacker could do with it.
• Do not send real customer data, passwords or private keys. A screenshot or a redacted example is enough.

What is in scope

• srvscripts.com and the subdomains we run: scr.srvscripts.com (script downloads) and transcribe.srvscripts.com (call transcription).
• The scripts published on this site and in github.com/srvscripts/scripts.
• Our online tools, for example a check that can be made to reach internal addresses or to attack someone else’s server.

Please do not

• Run denial-of-service or load tests, or flood our tools.
• Send spam, phish or social-engineer anyone.
• Access, change or delete data that is not yours, beyond the minimum needed to show the problem.
• Send raw scanner output without a working example.

What happens next

• We confirm that we received your report and look into it.
• We tell you what we found and what we will change.
• When it is fixed, we can thank you by name on this page if you want us to.
• We do not run a paid bug bounty. We treat reports made in good faith and within these rules as help, not as an attack.

Checking our scripts yourself

Every script page shows a SHA-256 checksum with ready-to-copy commands to verify the download on Linux, macOS and Windows, and a “Before you run it” box that says what the script changes, the rights it needs and how to undo it. The free scripts are also on GitHub, so you can read every line before you run anything. See how we test for what each testing level means.