Security

Security policy

SnmpLens handles credentials for network equipment. That deserves a page saying exactly what it does with them and how to tell us when it gets it wrong.

Reporting a vulnerability

What helps:

• The version affected and the platform.
• What an attacker gains, and what access they need to start.
• Steps to reproduce. A failing test is the clearest possible form.

This is a project maintained in someone's own time, so please do not expect a same-day answer. Reports are acknowledged, and a fix ships in a release with the problem described in its notes.

Supported versions

Fixes go into the next release from main. There are no long-term support branches; the application updates itself, and the answer to “am I affected” is normally “update”.

What the application does

Credentials

Community strings, v3 passphrases, SMTP passwords, webhook tokens and syslog client keys are held by the operating system's own protection: DPAPI on Windows, the Keychain on macOS, a file readable only by your account on Linux. They are not stored beside the database, and the settings screen names the backend in use rather than saying “encrypted”, because those three defend against different things.

Be precise about what that buys: DPAPI and the Keychain tie the key to your account, while the Linux file keeps it away from other accounts and out of a copied profile, and nothing more. While the application runs, credentials are in its memory in the clear — every request builder needs them.

What is never written down

• Community strings and passphrases are removed from debug log entries as they are written, not when displayed, so they are never in the buffer.
• A receiver's error is scrubbed of the credential before it is recorded, including the base64 forms SMTP actually puts on the wire — a relay that echoes an AUTH line would otherwise write the password into the database.
• A sink's secret is write-only across the interface: the application never sends a stored credential back to the screen.

Transport

• Syslog over TLS follows RFC 5425, with certificate verification on and the hostname checked, and supports mutual TLS.
• SMTP supports implicit TLS and STARTTLS, and refuses to send credentials before the connection is encrypted.
• A webhook carrying a credential over plaintext http is refused unless you explicitly enable it, and never for a non-loopback host by accident.
• All three accept a private CA in PEM, so an internal collector can be trusted without turning verification off. Every option that loosens verification is named for what it actually does.

Content that arrives from the network

A trap is unauthenticated and its values end up in rendered messages. Anything written into a protocol where a character changes meaning is escaped: dot-stuffing for SMTP data per RFC 5321, header encoding that turns a newline into an escape rather than a new header, and sanitising for the RFC 5424 syslog header. Values substituted into a template are never re-scanned, so a trap OID that reads like a placeholder stays text.

Releases

Each release carries a SHA-256 manifest and an Ed25519 signature over it. The application verifies the signature against a key compiled into the binary before it trusts the manifest, and a build whose signature is missing refuses the update rather than applying it. See verifying a download.

Privileges

SnmpLens does not ask for elevation and does not need it. Ping and traceroute are pure Go rather than wrapped system tools, autostart is a per-user login entry and never machine-wide, and a trap listener on a port below 1024 will simply fail rather than prompt.

In the repository

CodeQL runs over the Go and frontend code on every push and weekly — weekly as well, because a query added after a commit landed would otherwise never see it. Dependencies are reviewed on pull requests, scanned with govulncheck and npm audit, and pinned by commit SHA with automated updates, since pinning without something to move the pins just freezes them.

Scope

These are known and are not vulnerabilities:

• SNMP v1 and v2c send the community string in the clear. That is the protocol. SnmpLens supports them because networks still use them; use v3 where you can.
• Anonymous Mode is a display mask, not encryption. The underlying data is unchanged and an export contains real values.
• Anyone with your user account can read what your user account can read. The credential store defends against a copied profile and other accounts on the machine, not against code already running as you.
• A SET writes to live equipment. There is no confirmation step by design.