> ## Documentation Index
> Fetch the complete documentation index at: https://docs.d0pam1ne.blackhatethicalhacking.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and safe use

> Run D0pam1ne safely: authorized testing only, locked down access, and data that never leaves your machine.

D0pam1ne is an offensive-security tool. Used well it is safe and private; used carelessly it can expose your instance or touch systems you are not allowed to test. Read this before you deploy.

## Authorized testing only

> [!WARNING]
>
> Only scan and attack systems you have explicit, written authorization to test. The intrusive attack tools send real payloads and can change state on a target. The scope guard enforces your in-scope and out-of-scope rules on every request, but it is not a substitute for permission.

## Lock down access

* D0pam1ne Pro binds to every interface by default (`D0P_HOST=0.0.0.0`) so you can reach it on your LAN. **Firewall the port** to addresses you trust, or set `D0P_HOST=127.0.0.1` for local-only.
* **Require 2FA** for every account. Login and two-step are enforced on every network interface.
* Change the first-run admin password and delete `initial_admin.txt`.
* Keep the instance behind a VPN or a trusted network; do not expose it to the public internet.

## Your data stays yours

* The **AI is local**: an on-device Ollama model. D0pam1ne refuses any non-local AI endpoint, so project data, questions, drafts and reports never reach a cloud service.
* **Backups are encrypted** and passphrase-locked; without the passphrase the file cannot be opened.
* Secrets found during recon (in JavaScript, for example) are **masked and never validated** against the provider.

## Scope is enforced, out-of-scope always wins

The scope guard checks every host, name and URL against your rules. An out-of-scope rule always beats an in-scope one. A path-limited host is only ever crawled and probed within its allowed URLs and is never port scanned. Anything seen outside scope is logged, never probed.

> [!NOTE]
>
> Keep [Evasive Mode](/evasion/overview.md) on for sensitive engagements: it paces to what each host tolerates and backs off before it trips a WAF or degrades the target.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.