Add license and security policy

RedteamNotes · RedteamNotes · commit a373e267137e · 2026-06-03T11:47:48.000+08:00
diff --git a/LICENSE b/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 RedteamNotes
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/README.md b/README.md
@@ -11,7 +11,8 @@ A C# CLI tool for reading and modifying AD-Integrated DNS records over LDAP, bui
 <p>
   <img src="https://img.shields.io/badge/platform-Windows-blue" alt="Platform">
   <img src="https://img.shields.io/badge/language-C%23-239120" alt="Language">
-  <img src="https://img.shields.io/badge/license-MIT-green" alt="License">
+  <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-green" alt="License"></a>
+  <a href="SECURITY.md"><img src="https://img.shields.io/badge/security-policy-blue" alt="Security Policy"></a>
 </p>
 
 <p>
@@ -595,6 +596,16 @@ Type-specific data:
   cchNameLength (17 = label data including trailing 0x00)
 ```
 
+## Security
+
+Please do not disclose vulnerabilities in public issues or pull requests. See
+[`SECURITY.md`](SECURITY.md) for the reporting process, supported versions,
+coordinated disclosure expectations, and safe harbor terms.
+
+## License
+
+SharpADIDNS is released under the MIT License. See [`LICENSE`](LICENSE).
+
 ## Disclaimer
 
 For use in authorized security assessments, CTFs, and lab environments only. The author assumes no responsibility for misuse.
diff --git a/SECURITY.md b/SECURITY.md
@@ -0,0 +1,126 @@
+# Security Policy
+
+SharpADIDNS is a dual-use security and administration tool for AD-integrated
+DNS. This policy covers vulnerabilities in this project itself. It does not
+provide authorization to test, attack, or modify systems that you do not own or
+do not have explicit permission to assess.
+
+## Supported Versions
+
+This project does not maintain long-term support branches. Security fixes are
+handled for the latest tagged release and the `main` branch.
+
+| Version | Security support |
+| ------- | ---------------- |
+| Latest tagged release | Supported |
+| `main` branch | Supported on a best-effort basis |
+| Older tags or forks | Not supported |
+
+## Scope
+
+In scope:
+
+- Vulnerabilities in the SharpADIDNS source code.
+- Vulnerabilities in official release artifacts published from this repository.
+- Build, packaging, or documentation issues that could materially mislead users
+  into unsafe operation.
+- Supply-chain or repository-integrity concerns affecting this project.
+
+Out of scope:
+
+- Abuse of expected SharpADIDNS functionality against systems without
+  authorization.
+- Vulnerabilities in third-party environments, AD deployments, DNS
+  configurations, C2 frameworks, or operator infrastructure.
+- Requests for help bypassing detection, access controls, or organizational
+  policy in environments where you are not authorized.
+- Social engineering, physical attacks, spam, denial-of-service testing, or
+  attacks against GitHub, maintainers, or project users.
+- Theoretical reports without a plausible impact path.
+
+## Reporting a Vulnerability
+
+Please do not disclose vulnerability details in a public issue, pull request,
+discussion, gist, social post, or chat transcript.
+
+Preferred reporting channel:
+
+- Use GitHub Private Vulnerability Reporting for this repository, if available:
+  <https://github.com/RedteamNotes/SharpADIDNS/security/advisories/new>
+
+Fallback reporting channel:
+
+- If private reporting is not available, open a public issue titled
+  `Security contact request` and include only a brief, non-sensitive summary.
+  A maintainer can then arrange a private channel.
+
+Please include:
+
+- Affected version, tag, commit, or release artifact.
+- A clear impact statement and the security boundary being crossed.
+- Minimal reproduction steps or proof-of-concept details.
+- Relevant logs, command output, or screenshots with secrets removed.
+- Whether the issue is already publicly known or under active exploitation.
+- Any suggested remediation, if you have one.
+
+Do not include production credentials, tokens, private keys, customer data,
+domain names, IP addresses, or other sensitive environmental details unless the
+maintainer explicitly asks for them and a private channel has been agreed.
+
+## Handling and Disclosure
+
+Expected response targets:
+
+- Acknowledgement: within 3 business days.
+- Initial triage: within 7 business days.
+- Fix plan: based on severity, exploitability, affected versions, and release
+  complexity.
+
+Target remediation windows after confirmation:
+
+| Severity | Target |
+| -------- | ------ |
+| Critical | 14 days |
+| High | 30 days |
+| Medium | Next reasonable release |
+| Low | Best effort |
+
+For issues with broad user impact, the project may publish a GitHub Security
+Advisory, request a CVE, or release coordinated mitigation guidance. Public
+credit will be offered unless the reporter requests otherwise.
+
+Please coordinate public disclosure with the maintainers. As a default, wait
+until a fix or mitigation is available, or 90 days after the issue is confirmed,
+whichever comes first, unless both sides agree to a different timeline.
+
+## Safe Harbor
+
+The project will not pursue legal action against good-faith security research
+that:
+
+- Targets only systems, accounts, repositories, and data you are authorized to
+  test.
+- Avoids privacy violations, data destruction, persistence, lateral movement,
+  and service disruption.
+- Uses the minimum testing necessary to demonstrate the issue.
+- Reports the issue promptly and keeps details confidential during coordinated
+  disclosure.
+- Does not use the vulnerability for extortion, unauthorized access, or
+  operational advantage.
+
+This safe harbor applies only to this project and its maintainers. It cannot
+bind third parties, employers, service providers, customers, or other legal
+owners of affected systems.
+
+## Secure Use Expectations
+
+SharpADIDNS is intended for authorized security assessments, lab environments,
+CTFs, and controlled administration work. Operators should prefer `--dry-run`
+and `--backup-to` before write operations, keep engagement authorization and
+change records, and avoid including secrets or customer-specific details in bug
+reports.
+
+The maintainers may decline reports or requests whose primary purpose is to
+enable unauthorized operation, evade policy in third-party environments, or
+provide offensive tasking support rather than improve the security of the
+project.
diff --git a/SharpADIDNS.cs b/SharpADIDNS.cs
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2026 RedteamNotes
 // SharpADIDNS - A C# CLI tool for reading and modifying AD-Integrated DNS records over LDAP.
 
 using System;
diff --git a/docs/README.fr.md b/docs/README.fr.md
@@ -11,7 +11,8 @@ Outil CLI en C# pour lire et modifier les enregistrements DNS intégrés à AD v
 <p>
   <img src="https://img.shields.io/badge/platform-Windows-blue" alt="Platform">
   <img src="https://img.shields.io/badge/language-C%23-239120" alt="Language">
-  <img src="https://img.shields.io/badge/license-MIT-green" alt="License">
+  <a href="../LICENSE"><img src="https://img.shields.io/badge/license-MIT-green" alt="License"></a>
+  <a href="../SECURITY.md"><img src="https://img.shields.io/badge/security-policy-blue" alt="Security Policy"></a>
 </p>
 
 <p>
@@ -543,6 +544,17 @@ Données spécifiques au type :
   cchNameLength (17 = données de label incluant le 0x00 final)
 ```
 
+## Sécurité
+
+Ne publiez pas les détails d'une vulnérabilité dans une issue ou une pull
+request publique. Consultez [`SECURITY.md`](../SECURITY.md) pour le processus de
+signalement, les versions prises en charge, la divulgation coordonnée et les
+conditions de safe harbor.
+
+## Licence
+
+SharpADIDNS est publié sous licence MIT. Consultez [`LICENSE`](../LICENSE).
+
 ## Avertissement
 
 Réservé à la recherche autorisée, aux environnements de laboratoire et aux travaux d'administration en environnement contrôlé. L'auteur n'assume aucune responsabilité en cas d'utilisation abusive.
diff --git a/docs/README.zh-CN.md b/docs/README.zh-CN.md
@@ -11,7 +11,8 @@
 <p>
   <img src="https://img.shields.io/badge/platform-Windows-blue" alt="Platform">
   <img src="https://img.shields.io/badge/language-C%23-239120" alt="Language">
-  <img src="https://img.shields.io/badge/license-MIT-green" alt="License">
+  <a href="../LICENSE"><img src="https://img.shields.io/badge/license-MIT-green" alt="License"></a>
+  <a href="../SECURITY.md"><img src="https://img.shields.io/badge/security-policy-blue" alt="Security Policy"></a>
 </p>
 
 <p>
@@ -601,6 +602,15 @@ offset  size  field
   cchNameLength (17 = 标签数据含末尾 0x00 字节)
 ```
 
+## 安全反馈
+
+请不要在公开 issue 或 pull request 中披露漏洞细节。报告流程、支持版本、
+协调披露要求与安全港条款见 [`SECURITY.md`](../SECURITY.md)。
+
+## 开源许可
+
+SharpADIDNS 基于 MIT License 开源，详见 [`LICENSE`](../LICENSE)。
+
 ## 免责声明
 
 仅供授权研究、实验环境与运维测试使用。作者不对滥用承担任何责任。

Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,5 @@`
	`1`	`+// SPDX-License-Identifier: MIT`
	`2`	`+// Copyright (c) 2026 RedteamNotes`
`1`	`3`	`// SharpADIDNS - A C# CLI tool for reading and modifying AD-Integrated DNS records over LDAP.`
`2`	`4`
`3`	`5`	`using System;`