proxycheck has reached v1.0.0. Security fixes are provided on a best-effort basis for the latest 1.x release.

Please do not open a public GitHub issue for a vulnerability report.

Until a dedicated security contact is published, please report security concerns privately to the repository owner through GitHub profile/contact information or by opening a minimal issue that asks for a private contact channel without disclosing details.

When reporting, include as much of the following as possible:

• Affected version or commit
• Operating system and architecture
• Reproduction steps
• Expected behavior
• Actual behavior
• Impact assessment
• Whether credentials, proxy logs, or internal hostnames are involved

Examples of in-scope issues:

• Proxy credentials accidentally exposed in output, logs, or errors
• Incorrect handling of TLS verification options that creates unexpected trust behavior
• Header injection or request formatting behavior that could cause unintended traffic
• Crashes or hangs caused by malformed targets or proxy responses

Examples usually out of scope:

• Issues caused by intentionally using --insecure
• Misconfiguration of a third-party proxy, SWG, firewall, or TLS inspection product
• Tests against systems you do not own or are not authorized to assess

Use proxycheck only against proxy environments and target systems that you own or are authorized to test. The tool is intended for client-side operational validation of HTTP proxy and TLS inspection behavior, not for unauthorized scanning or bypass attempts.