CrawlBEAM is pre-1.0 software. Security fixes are applied to the latest commit on the default branch.

Do not open a public issue for a vulnerability that could expose credentials, private targets, generated reports, or operators' networks. When this project is published, add a private security contact or enable GitHub private vulnerability reporting before accepting third-party reports.

Until then, document the reproduction locally without including secrets or data from a real website.

CrawlBEAM fetches operator-supplied URLs. Treat every target and response as untrusted.

• Audit only sites you own or are authorized to test.
• Keep robots compliance enabled unless an authorized test explicitly requires otherwise.
• Do not expose the crawler as an unauthenticated public service.
• Do not place cloud metadata hosts, loopback services, private network ranges, credentials, or signed URLs in jobs.
• Review generated HTML before sharing it; URLs and page metadata may contain confidential information.
• Store Search Console or analytics credentials outside the repository.

The current local-first release is not an SSRF-hardened multi-tenant service. Network egress policy and target allowlisting are deployment responsibilities.