Only the latest release of Undercurrent is supported with security updates.

Do NOT open public issues for security vulnerabilities.

If you discover a security vulnerability in Undercurrent, please report it responsibly:

1. Preferred: Use GitHub Security Advisories to create a private report.
2. Alternative: Email the maintainers directly with details of the vulnerability.

• Description of the vulnerability
• Steps to reproduce
• Affected versions
• Potential impact
• Suggested fix (if any)

• Acknowledgment: Within 48 hours of receipt
• Assessment: Within 7 days
• Fix & Disclosure: Within 90 days (coordinated responsible disclosure)

We follow a 90-day responsible disclosure timeline. If a fix is not released within 90 days, the reporter may disclose the vulnerability publicly.

Undercurrent is a penetration testing tool designed for authorized security assessments. The following behaviors are features, not bugs:

• io_uring-based network I/O that bypasses traditional syscall monitoring
• ChaCha20-Poly1305 authenticated encryption of all traffic
• In-memory payload staging without disk artifacts
• Position-independent shellcode generation
• Evasion of strace, auditd, seccomp-bpf, and EDR syscall hooks
• Reverse TCP connection to operator-controlled listeners
• Binary patching of C2 addresses and pre-shared keys

These capabilities exist by design for legitimate security testing. Reports that simply describe Undercurrent working as intended will be closed.

Undercurrent is intended for authorized penetration testing, security research, and educational purposes only. Users are responsible for ensuring they have proper authorization before using this tool against any systems.