Skip to content

Security policy

Reporting a vulnerability

Please don't open a public issue for security problems. Use GitHub's private reporting instead: Security → Report a vulnerability on this repository. If that isn't available, email the maintainer (see the GitHub profile).

Include what you found, how to reproduce it, and the impact. You should get a reply within a week.

How NetMap is designed to stay safe

  • Local only by default. The dashboard listens on 127.0.0.1, so other devices can't reach it. --host 0.0.0.0 exposes it to your network with no login; only use that on networks you trust.
  • Least privilege for capture. The web server runs as your normal user. Only the small capture_helper.py runs with admin rights, after the OS password prompt. It uses only the Python standard library, talks to the server over 127.0.0.1 with a random one-time token, and exits when that connection closes.
  • No uploads. Captures are analyzed on your machine. The only outbound requests NetMap makes are:
  • your public IP lookup (api.ipify.org, with fallbacks); turn it off with --no-ip-lookup
  • reverse DNS through your normal resolver; turn it off with --no-rdns
  • map tiles, JavaScript libraries and fonts loaded by the browser
  • Uploaded files are stored in the system temp folder under a random name, accepted only with a capture extension, and deleted after analysis. Sample files can only be opened by exact name from the project folder.

Scope

NetMap's alerts are heuristics for learning and triage. It is not an intrusion detection system and should not be relied on as one.

Only capture traffic on networks you own or have permission to monitor.