Security Policy

Authorized Use Only

Wallbreaker is an offensive security research tool for red-teaming and safety evaluation of large language models. It exists so defenders, alignment researchers, and model providers can find and fix weaknesses before adversaries exploit them.

Use Wallbreaker only against:

• Models and endpoints you own or operate, or
• Targets you have explicit written authorization to test (e.g., a provider’s red-team program, a bug-bounty scope, an internal evaluation).

Do not use it to attack third-party services without permission, to generate or distribute genuinely harmful operational content, or in any way that violates the target provider’s terms of service or applicable law. You are responsible for how you use it.

What the Tool Produces

Wallbreaker generates adversarial prompts and records model responses for evaluation. Run logs, findings, and generated artifacts can contain sensitive or harmful material. They are written to:

All of these are gitignored — keep them out of version control and handle them as sensitive data.

Sandbox Containment

The run_shell tool executes commands in the harness working directory. The write_file, edit_file, and patch_file tools confine targets to ctx.cwd via _confine — realpath containment means absolute paths that escape the working directory are redirected, and .. traversal or escaping symlinks are blocked. This prevents the agent from writing to arbitrary filesystem locations.

Dashboard & Egress Hardening

The web dashboard launches with token authentication enabled (require_auth=True): a token is generated at startup, printed to the terminal and stored in a token file, and every API call must present it via the X-WB-Token header. The server binds to loopback by default; exposing it beyond loopback requires an explicit --allow-network acknowledgement.

Outbound requests from tool calls pass through the egress guard (tools/egress_guard.py): DNS-resolved IPs are checked against private/link-local ranges (SSRF defense), redirect chains are validated, and the dashboard’s provider transport is pinned to validated addresses so a hostname cannot silently re-resolve to an internal host mid-session.

A tool policy layer (tools/tool_policy.py) governs which tools the agent may invoke, and runtime-fetched corpora are integrity-checked against the SHA pins in library.lock.toml — a mismatch fails closed rather than loading tampered data.

Reporting Vulnerabilities in Wallbreaker

If you find a security issue in the harness itself (e.g., a sandbox escape in run_shell, a secret-leak path, an unsafe default), please open a private report rather than a public issue:

• Use GitHub’s “Report a vulnerability” (Security Advisories) on the repository
• Contact the maintainers listed in the organization

Include reproduction steps and impact assessment.

Handling Extracted System Prompts

leak_scan and related tools may surface a target’s hidden system prompt. Treat any extracted prompt as the provider’s confidential material — report it through their responsible-disclosure channel; do not publish it.

Data Sensitivity

License Compliance

Wallbreaker is licensed under AGPL-3.0-or-later: any modified version (including one run as a network/hosted service) must make its complete corresponding source available under the same license. Third-party jailbreak corpora (L1B3RT4S, P4RS3LT0NGV3, ENI) are fetched at runtime, not redistributed; see the NOTICE file.