Authorised use and limitations
Use only systems you own or are expressly authorised to administer. Port knocking does not replace SSH keys, TLS, restrictive firewall rules or a VPN. Static sequences can be observed and replayed. No guarantee against intrusion is made.
No network discovery, port-range scanning, background sending, remote commands or credential management. Imported command, start_command and stop_command lines are never executed. TCP uses ordinary connection attempts, not arbitrary TCP flags.
Report vulnerabilities
Send confidential reports to joshua.baums@informatik-baums.de with subject “PortKnock Security”. Include version, prerequisites and safe reproduction steps without production sequences or credentials. Agree on a suitable channel before sharing sensitive details; ordinary email is not end-to-end encrypted throughout.