PwnPress CLI is intended for authorized WordPress security assessment.
Only run scans or modules against systems where you have explicit permission. Some modules can generate significant traffic or exercise offensive security workflows. Use rate limits, controlled test environments, and written authorization where appropriate.
If you find a vulnerability in PwnPress itself, please avoid public disclosure until there has been time to investigate and prepare a fix.
Report security issues to:
Include:
- Affected version or commit
- Clear reproduction steps
- Impact
- Any relevant logs or proof of concept details
Do not include third-party secrets, customer data, or data from systems where you do not have authorization.
PwnPress supports Wordfence API keys. Keep keys out of commits, screenshots, logs, and shell history where possible.
For CI, store keys in the CI secret manager and expose them as PWNPRESS_WORDFENCE_API_KEY.