VibeSensor is an active-development lab project. Security fixes are handled on main first and are included in the latest GitHub release when a release is needed for Raspberry Pi or firmware users.

VibeSensor is designed as an offline/local Raspberry Pi appliance, often served from its own hotspot. Read-only dashboard endpoints are open to devices that can reach the local server. Mutating HTTP endpoints (POST, PUT, PATCH, and DELETE) reject browser-style requests with an Origin or Referer header that does not match the request host. This is a same-origin/CSRF boundary for local UI use, not user authentication.

Direct local clients such as curl, scripts, or same-origin UI requests can still call mutating endpoints. Secure deployments should still set a hotspot PSK, limit who can join the local network, and avoid exposing the server outside the trusted appliance network.

Use GitHub private vulnerability reporting from this repository's Security tab when it is available. Include the affected component, reproduction steps, impact, and any logs or screenshots that do not expose real credentials.

If private vulnerability reporting is unavailable, open a GitHub issue titled Security disclosure request with no exploit details, secrets, logs, or affected host information. A maintainer will move the discussion to a private channel.

Do not publish proof-of-concept exploit details until a maintainer has confirmed the report and a fix or mitigation is available.

Security reports are triaged against the active main branch. Accepted reports are fixed on main and released when users need a new artifact. Reports for unsupported old releases or local forks may be declined unless they also affect the supported scope above.