diskos/SECURITY.md

Security policy

diskOS is an unsupported beta that flashes firmware over a device's mask-ROM USB mode. Because a defect here can brick a device or write to the wrong hardware, security and safety reports are taken seriously.

Reporting a vulnerability

Do not open a public issue for a security or device-safety vulnerability. Instead, use GitHub's private vulnerability reporting for this repository (the "Report a vulnerability" button under the Security tab), which opens a private advisory visible only to the maintainer.

Please include, where relevant:

• What the issue is and how to reproduce it.
• The impact (e.g. writes outside the intended partition, wrong-device targeting, host privilege issues, data exposure).
• Your host OS, the installer version, and the device firmware version.

Please redact anything device-identifying from logs before sending: serial numbers, Bluetooth/Wi-Fi MAC addresses, and network credentials.

Especially in scope

• Wrong-device / wrong-partition writes - anything that could let the flasher erase or write a device it should have refused, or write outside the intended rootfs region.
• Host privilege issues - the installer is designed to run as your normal (non-root) user (USB access via the bundled udev rule); it should not need sudo. Path-traversal, symlink-follow, arbitrary-delete, or predictable-temp-file issues matter.
• Unauthenticated input - the installer extracts a squashfs and decrypts a firmware package; report anything that lets crafted input escape the work directory or run code.
• Bricking-class bugs - a report that a specific sequence leaves a device unrecoverable.

Debug Mode (on-device remote access)

diskOS has an opt-in Debug Mode (Settings → System → Debug Mode), off by default, that starts an SSH server over WiFi. It uses a random password generated per enable, placed into a private shadow file bind-mounted over /etc/shadow; the device's stock password is never used or exposed. While it is on, it grants root access over the network.

• Password storage: while Debug Mode is on, the current password is also stored in plaintext at /usr/data/sshd/current_pw (mode 0600, root-only) so the UI can redisplay it after a restart; disabling Debug Mode deletes it. A reboot while still enabled can leave a stale copy - the SSH overlay is dropped on reboot so that password no longer authenticates until re-enabled. It is only as protected as root/physical access to the device.
• SSH server: Dropbear 2022.83, which predates the CVE-2023-48795 "Terrapin" Strict-KEX mitigation (update planned); exposure is limited by Debug Mode being opt-in and short-lived.
• Serial: the local USB-serial root shell exists only on dev builds and is passwordless-root by design (physical-USB access only); public builds have no serial shell. Report only if it is reachable without physical access.

In scope: anything that exposes the debug password, leaves SSH running (or the shadow overlay mounted) after it should be off, lets the overlay corrupt/leak the on-disk credentials, or reaches the stock /etc/shadow over the network.

Response

This is a hobbyist project with no SLA, but security and bricking reports are prioritised over features. Expect an initial acknowledgement within a week or so. Fixes for confirmed device-safety issues will be called out clearly in the release notes.

Supported versions

Only the latest release is supported. There are no backported fixes for older builds.