SimplrSSH is a handheld SSH client for the LilyGO T-Deck (ESP32-S3) and the M5Stack Tab5 (ESP32-P4, WiFi through an ESP32-C6 co-processor), built from one source tree. Its job is to join a WiFi network the user picks, open SSH sessions to servers the user enters, and - only when the user opens ChatGPT with their own API key - talk to api.openai.com. It should talk to nothing else.

Please open a private security advisory on the GitHub repository (Security tab, "Report a vulnerability") rather than a public issue.

Not in scope: an attacker with physical access and time to brute-force a short PIN offline (use 6+ characters), or one who can reflash the device (enable secure boot + flash encryption for that).

A full sweep for malicious code, unexpected data flows and vulnerabilities.

• Project code (main/): the only network activity is WiFi scan/join, DNS resolution of the SSH host the user typed, and the TCP connection to that host. No other sockets, HTTP, MQTT, SNTP, mDNS or hard-coded addresses.
• Third-party components: no component other than libssh2 opens sockets or resolves names. skuodi/libssh2_esp 1.1.0 contains libssh2 sources byte-identical to upstream commit 4ed26f5 (2025-10-20); its ESP-IDF glue (CMake, compat.h, libssh2_config.h, Kconfig) is benign. Espressif (esp_bsp_generic, esp_lvgl_port, esp_lcd_*) and LVGL components are official releases, verified against the registry hashes in dependencies.lock on download.
• Built firmware: no URLs, domains or IP addresses other than SSH algorithm names (...@openssh.com) and the 192.168.1.100 example in the help text.
• "CN" in the firmware: this is ESP-IDF's default WiFi regulatory country code (it selects channels 1-13); it is not a network destination.
• Residual trust: Espressif's WiFi driver ships as closed-source binary libraries, as on every ESP32 product. They cannot be audited; they are the vendor's signed releases.

Requiring a master PIN before any password could be saved meant networks silently weren't saved when the PIN step was skipped, and every restart stopped at a PIN prompt. Saved passwords now default to a random per-device key (automatic unlock, WiFi reconnects on its own); the PIN is optional. Trade-off: without a PIN, someone with the device and a flash reader can recover saved passwords, since the key is on the same chip. SD card backups remain unreadable elsewhere (the device key is never exported). Set a PIN, or enable flash encryption, for devices that may be lost.

Every push and pull request runs the Tests workflow (.github/workflows/tests.yml), and a release waits for it to pass on the same commit. Security-relevant gates:

• Secrets: host tests check that the vault never stores or logs plaintext, that tampered or moved ciphertext is rejected, that PINs use the slow key derivation, and that typed passwords are redacted from echo and history; guard tests reject log statements that print user input or secrets; gitleaks scans the new commits; the built images are scanned for private keys and API keys (with a planted-key negative control).
• Untrusted SD card input: restore tests feed damaged and hostile backups (unknown namespaces, the device-key namespace, oversized or malformed records) and check that the device is left unchanged.
• Network surface: the linked firmware (both boards) may not contain listening sockets, HTTP servers, OTA (including the Tab5 co-processor's), Bluetooth, mDNS or access-point code, must link CA-bundle TLS verification, SSH host key checks and RAM-only WiFi credential storage, and its generated sdkconfig must keep SoftAP, DHCP server, IPv6 and Bluetooth off.
• Supply chain: actions pinned by SHA and images by digest (enforced), components installed only at the locked versions with verified hashes (each board has its own lock file), and a CVE audit (esp-idf-sbom, NVD) of ESP-IDF, its libraries and the components of both images that blocks on new high/critical findings.

Found while introducing these checks:

A second firmware image (SimplrSSH-Tab5-*) for the M5Stack Tab5 with the Tab5 Keyboard, built from the same sources; only the board layer differs (main/board_tab5.cpp, tab5_keyboard.cpp, tab5_keymap.cpp, battery_tab5.cpp, audio_tab5.cpp).

Hardware behaviour on the Tab5 has not been confirmed on a device yet.

• Flash is not encrypted. Non-secret data (profiles, known hosts, command history, SD keys while inserted) can be read from the chip, and from an SD card backup. Enable secure boot and flash encryption for high-risk use.
• Private keys on the SD card are stored however you copied them; prefer passphrase-protected keys.
• Deleted NVS entries are marked erased but may physically remain until the NVS page is recycled.
• A server that adds a new host key type can trigger a "key changed" refusal; verify, then hosts forget.
• Installed with a launcher (-launcher.bin, e.g. bmorcelli/Launcher): the launcher's own code runs first, before SimplrSSH, and can read, back up, restore and erase every partition, including SimplrSSH's simplrssh settings partition (the vault stays encrypted; without a PIN its key is in the same partition). Only use a launcher you trust, and set a PIN. Installed from -launcher.bin, SimplrSSH never touches the launcher's nvs; installed from an image without its own partition it has to store its settings there (warned at boot) and never erases it.
• skuodi/libssh2_esp tracks a libssh2 development snapshot rather than a tagged release. Re-verify it against upstream (see above) when updating.
• Tab5: the ESP32-C6 runs Espressif's closed WiFi stack plus whatever esp_hosted firmware the Tab5 shipped with; SimplrSSH neither updates nor verifies it. A compromised C6 sees WiFi traffic (still TLS / SSH protected end to end), as a compromised WiFi driver would.
• The CVE audit only sees packages with a CPE in the SBOM (ESP-IDF, mbedTLS, lwIP, FreeRTOS, newlib, cJSON, wpa_supplicant...). Registry components such as libssh2 and LVGL are listed but not matched against the NVD; review their upstream advisories when updating them.