# Scope and ethics

> What this tool is for, what it is not for, and the rules that keep replay safe and honest.

Exploitmatic is an offensive-security tool. It replays attack techniques against targets. Use it only against systems you own or are authorized to test.

## Replica workflow

The workflow has two stages: refine the solution against a local replica of the vulnerable surface, then verify against an authorized target. A result from a replica is a hypothesis refinement. A result from an authorized target is a finding.

## Host scope

Host-level steps (`process`, `file`) reach into the operator's own host. They are not gated: the runtime runs on your machine because you started it. A sandboxed scanner cannot reach this scope at all.

## Honest findings

The runtime prints what was sent and received; it does not claim a target is secure. The wording is "verified against corpus", never "secure". Solutions stay deterministic where possible, with honest reproducibility stats for probabilistic solutions, never a false finding.

## License

The runtime is Apache-2.0. The attack
solutions (`.txt` files) in the
[exploitmatic/solutions](https://github.com/exploitmatic/solutions) repository
are Apache-2.0 as well.