Lift is intended for defensive testing of systems you own or are explicitly authorized to assess.

Lift is an intrusive-on-purpose auditor. Its active probes plant only benign canaries (a marker file, a proof-of-load DLL/EXE, or a junction to a Lift canary directory) and run de-elevated as your standard-user token, so a proof reflects what a normal user can do rather than Lift's admin rights. Every active probe is confirmed and reversible.

Never run experimental probes on production hosts. Use a disposable Windows VM with snapshots. Do not target Windows system directories, Config.Msi, RPC Control, other users' data, or network shares.

An initial internal security review of Lift's own code was performed before the first public release, covering the highest-risk areas: privilege/token impersonation and de-elevation, junction/reparse-point planting and cleanup, the path-safety guards, trace deserialization, and process launches. Findings from that review were addressed (notably: active probes now refuse to run at all when Lift is elevated and cannot de-elevate, rather than falling back to an elevated write). This was an initial self-review, not a formal third-party audit - treat it as such.

Lift requires Administrator to record and scan. Only load traces (JSONL / Process Monitor CSV) from a source you trust: the paths inside a trace drive Lift's active probes.

Please report vulnerabilities in Lift privately before public disclosure:

• Email: lab@zeroscience.mk (Zero Science Lab)
• Web: https://www.zeroscience.mk

Advisories produced with Lift against third-party software are coordinated with the affected vendor first, and are published only after that coordination.