LANsight is pre-1.0. Security fixes land on the latest release only.

Do not open a public issue for a security vulnerability.

Report it privately through GitHub's private vulnerability reporting (Security tab → Report a vulnerability). The report stays private between you and the maintainers until an advisory is published.

Please include:

• What the issue is and roughly how severe you think it is
• Steps to reproduce, or a proof of concept
• The version and platform you found it on

You can expect an acknowledgement within a few days. Since this is a volunteer-maintained project, please allow reasonable time for a fix before public disclosure — 90 days is the usual guideline, and I'll keep you updated on progress.

Credit is given in the release notes unless you'd rather stay anonymous.

LANsight is a desktop application that parses untrusted data pulled off the network — service banners, HTTP page titles, TLS certificate fields, SNMP and SSDP replies, and reverse-DNS names — and renders it in an Electron window. That is the main risk surface. Things I especially want to hear about:

• Any path from scanned network data to code execution, in the renderer or the main process (banner content escaping into HTML, prototype pollution via parsed data, and so on)
• Escapes from the context-isolated preload bridge, or ways to invoke IPC channels the renderer should not reach
• Path traversal or arbitrary write via the report export or scan-history storage
• Crashes triggered remotely by a malicious host responding to a probe — a device on the scanned network answering in a way that takes the scanner down
• Anything causing LANsight to send traffic to a host outside the configured target range

• contextIsolation: true, nodeIntegration: false, no webviewTag
• A restrictive CSP with no remote origins — the renderer never loads anything off the network
• Navigation and window-open are blocked; only http(s) URLs are handed to the system browser
• The renderer reaches the main process only through a fixed set of named preload functions, never a raw ipcRenderer
• Banner and certificate text is stripped of control characters and length-clipped before it reaches the UI, and React escapes it on render

• The tool doing what it is designed to do. LANsight is an active scanner: it probes hosts and reports open ports. That it can be pointed at a network is not a vulnerability.
• Findings you disagree with — severity ratings and false positives are ordinary issues, please file them publicly.
• Vulnerabilities in the scanned devices that LANsight reports. Those belong to the vendor of that device.
• Missing sandbox on a self-built Linux binary where chrome-sandbox was not set up (see the README).

Reports demonstrating an issue by scanning infrastructure you do not own or have permission to test will not be accepted. Reproduce against your own lab.