Please report security problems privately, never in a public issue, pull request or discussion.

Use GitHub's private vulnerability reporting: on this repository's Security tab, choose Report a vulnerability. Only the maintainers see the report, and a fix can be prepared in a private fork before anything is public.

If you cannot use GitHub's reporting, email hello@openfollow.app instead.

Include what you can of:

• the OpenFollow version (shown on the About page) and how it was installed (Raspberry Pi image, .deb, macOS app);
• what an attacker needs: a place on the show network, a browser session, the web PIN, physical access;
• the steps that reproduce it, and what happens;
• a diagnostics file from the station (web UI: Diagnostics → Bundle & tools → Download diagnostics bundle; Operator Screen: Settings → Export Diagnostics File for Support);
• anything you have found about how to fix it.

A diagnostics file has every credential redacted, so it is safe to attach. Please do not attach a configuration file (.ofsettings) or a settings backup (.ofbackup) instead: they carry the camera logins and SRT passphrases the station uses.

We acknowledge a report as soon as we can and agree a disclosure date with you. The fix ships in a new release, and the advisory is published once that release is available, crediting you unless you would rather not be named.

Security fixes go into the newest release. There are no long-term support branches, so update to the latest release to receive them. A release candidate is covered while it is the newest build.

OpenFollow runs on show networks, usually with no internet connection. In scope are:

• the web UI and its API;
• traffic between stations: settings pushes, discovery, marker catalog sync;
• the update path: .ofupdate signature checks and the privileged helpers;
• the packaging: the .deb, the Raspberry Pi image and the macOS app.

These are known limits of the current design and are not treated as vulnerabilities on their own:

• PSN, OTP, RTTrPM and OSC carry no authentication by protocol design. OSC input can be restricted with osc.allowed_sender_ips.
• Without a web PIN, the web UI and its API are open to anyone on the network.
• The web UI is served over plain HTTP.