If you discover a security vulnerability, please do not open a public GitHub issue.

Instead, report it privately to the repository maintainer via GitHub Security Advisories:

https://github.com/salvomazzaglia/network-device-watch/security/advisories/new

Include:

• A description of the vulnerability and impact
• Steps to reproduce
• Affected version(s)
• Suggested fix (if available)

We aim to acknowledge reports within 5 business days.

network-device-watch is designed as a read-only, non-enforcing inventory tool:

• It does not scan, ping, or connect to remote hosts.
• Classification labels are advisory metadata — they do not block or isolate devices.
• Collectors read local OS neighbor caches with fixed-argument subprocess calls (shell=False).

This limits the attack surface compared to active network management tools, but operators must still protect local inventory data.

The inventory database stores full MAC addresses, IP addresses, and hostnames regardless of report privacy mode. Protect the database file with appropriate filesystem permissions and encryption at rest if required by your policy.

Default path: data/inventory.db (configurable).

• masked (default): partial redaction suitable for sharing within a trusted team.
• hashed: SHA-256 digests; set NETWORK_DEVICE_WATCH_HASH_SALT for production use.
• full: complete identifiers — treat reports as confidential.

Never commit these values. They are not written to config files or reports.

1. Telegram notifications transmit masked device summaries to Telegram's infrastructure when enabled. Review Telegram's terms and your data-handling policy before enabling.
2. Hashed mode without salt produces correlatable digests — not strong anonymization.
3. Full privacy mode emits a stderr warning because reports contain complete local network identifiers.
4. Database path validation rejects paths ending in executable extensions (.exe, .dll, etc.) but does not prevent all path manipulation — use trusted config sources.
5. Subprocess collectors execute platform-specific read commands with timeouts; they do not accept user-supplied shell strings.

Runtime dependencies: none (Python stdlib only). This reduces supply-chain risk. Development dependencies (pytest, ruff, mypy) are used only at build/test time.

• Run with least-privilege OS accounts.
• Restrict read access to the SQLite database and report output directories.
• Keep notifications disabled unless Telegram alerting is explicitly required.
• Use masked or hashed privacy modes for reports shared outside the operations team.
• Validate config and policy files from trusted sources (validate-config command).
• Do not ingest observation files from untrusted origins without review.

We follow coordinated disclosure:

1. Private acknowledgment and triage
2. Fix development and verification
3. Patch release with CHANGELOG entry
4. Public advisory after users can upgrade