Security: awesomestvi/navet

If you believe you found a security vulnerability in Navet, do not open a public GitHub issue.

Report it privately to:

• security@navet.app

Please include:

• a description of the issue
• affected versions or deployment modes if known
• reproduction steps or proof of concept
• impact you believe the issue could have
• any suggested mitigation if you have one

We will try to acknowledge reports promptly and follow up as we validate and triage the issue.

Security reports are especially relevant for:

• authentication and session handling
• provider proxies and resource rewriting
• imported dashboard data
• RSS, media, camera, and external URL handling
• Docker and Home Assistant add-on deployment behavior

Use this checklist when Navet is reachable outside a private local network.

Navet is a smart-home control surface. Treat provider sessions, camera and media URLs, imported dashboard data, and external feeds as sensitive.

• serve Navet behind HTTPS
• do not ship real provider credentials in static assets, demo content, or exported configs
• use least-privilege provider accounts where possible
• keep public demo data on demo.navet.app only
• validate release and deployment changes before publishing

• standalone runtime stores session state behind same-origin endpoints, not in bundled config
• do not reintroduce manual token-entry login flows
• do not put access or refresh tokens into dashboard exports
• do not expose provider secrets in public files or logs

Important same-origin endpoints include:

• /__navet_auth__/session
• /__navet_profile__/default
• /__navet_ha_proxy__/
• /__navet_homey__/ and /__navet_homey_proxy__/
• /__navet_openhab__/session and /__navet_openhab_proxy__/
• /__navet_rss_proxy__/
• /__navet_spotify_metadata__/
• /__navet_music__/spotify/callback

Home Assistant discovery and provider OAuth/session callbacks are also security-sensitive even when they do not proxy arbitrary provider data. Keep Homey client secrets and music-service credentials server-side; never expose them through public Vite variables or dashboard exports.

Keep them tightly scoped:

• validate target URLs and hosts
• avoid token leakage in query strings
• prevent arbitrary proxying or redirects
• keep resource rewriting and signing in place

Pay extra attention to:

• camera snapshots and streams
• media artwork and entity pictures
• RSS feeds and links
• imported photo URLs
• map tiles and tracker resources
• notification links

If a resource can no longer be resolved safely, fail closed or fall back to a neutral placeholder.

• keep nginx security headers aligned across Docker and add-on deployments
• enable HSTS only at a real HTTPS terminator
• do not weaken production security just to simplify localhost development

Before a public release:

• run the provider validation flow
• run Docker validation with pnpm check:docker
• keep pnpm typecheck and pnpm check as user-run gates per repo policy

If a deployment change might weaken auth, proxying, or resource handling, treat that as a release blocker until reviewed.

Please give the maintainers reasonable time to investigate, fix, and coordinate disclosure before sharing details publicly.

If a report is confirmed, the fix will be shipped through the normal Navet release process and the relevant release notes.