Skip to content

Security: vincenzo-afk/SHADOWGHOST

Security

SECURITY.md

Security Policy

Supported versions

Only the current main branch is maintained at this time. No additional release or backport branches are published.

Reporting a vulnerability

Please do not open a public issue for a suspected vulnerability. Use GitHub's private vulnerability-reporting flow from the repository's Security tab when it is available for this repository. If that private reporting option is not available, contact the maintainer through the @vincenzo-afk GitHub profile and include the repository name, a concise description, reproduction steps, affected files or endpoints, and any suggested mitigation.

Please avoid including live credentials, personal sensing data, raw CSI captures, recordings, or other sensitive material in a report. Redact secrets and share only the minimum evidence needed to reproduce the issue.

Security notes

SHADOWGHOST is a local development application. Its REST and Socket.IO interfaces do not implement authentication or rate limiting, and the development server enables permissive cross-origin requests for the bundled dashboard. Before exposing it to an untrusted network, add an authenticated production serving layer, restrict allowed origins, protect recording and reset operations, set a private SECRET_KEY, and review how sensing data is stored and retained.

There aren't any published security advisories