Security audit findings — 5 PRs submitted with fixes

[JULIANDEV21989]

Hi @zakirkun,

I performed a comprehensive security audit of Deep Eye v1.3.0 and found several issues. Rather than just reporting them, I've submitted 5 pull requests with working fixes:

PR	Finding	Severity
#28	XSS/XXE payloads use hardcoded attacker.com as OOB callback — leaks target data to unknown third party	HIGH
#29	Notification webhooks send raw vulnerability evidence (tokens, cookies) to Slack/Discord without sanitization	HIGH
#30	Path traversal via unsanitized session_id in collaborative scanner	MEDIUM
#31	Deprecated asyncio PyPI backport in requirements (supply chain risk)	MEDIUM
#32	Added SECURITY.md with responsible disclosure process and safe usage guidelines	DOCS

Additional recommendations (no PR needed):

• Plugin system (core/plugin_manager.py): exec_module() without sandboxing is architecturally risky. Consider subprocess isolation for future versions. Currently mitigated by being disabled by default.
• Dependency pinning: All 35+ deps use >= without upper bounds. Consider generating a requirements.lock with pip-compile.
• SSL config: verify_ssl: false disables TLS globally including for AI API key transport. Consider separating scan HTTP client from AI provider HTTP client.

Great project — the codebase is well-structured and the AI integration is solid. These are refinements, not fundamental issues.

Best,
Cristian Cedeno

---

Audit performed with Claude Code — 6 specialized security agents analyzing ~40 files in parallel

[zakirkun]

Thanks you!