RoleDiff executes explicitly configured HTTP requests. Treat suites and credential environment variables as trusted operator input. Use controlled test accounts and data on systems you are authorized to test.

A passing report is limited to the supplied expectations. It does not certify API security or discover every authorization flaw. See the README for request, response and cancellation behavior.

Report issues using fictional data. Do not include real tokens, cookies, private endpoints or sensitive API responses in public issues. If this repository enables private vulnerability reporting, use its Security tab; otherwise contact the maintainer privately before sharing sensitive details.