Skip to content

Security: elder-plinius/V3SP3R

Security

SECURITY.md

Security Policy

Supported Versions

Version Supported
Latest main Yes
Older releases Best effort

Reporting a Vulnerability

If you discover a security vulnerability in V3SP3R, please report it responsibly.

Do NOT

  • Open a public GitHub issue for security vulnerabilities
  • Post details in Discussions or social media before a fix is available

Do

  1. Email: Send a detailed report to the repository maintainers via GitHub's private vulnerability reporting
  2. Include:
    • Description of the vulnerability
    • Steps to reproduce
    • Potential impact
    • Suggested fix (if you have one)
  3. Allow time: Give us reasonable time to investigate and release a fix before public disclosure (90 days is standard)

Security Architecture

Vesper takes security seriously at every layer:

Risk Classification

Every AI-initiated action is classified before execution:

Level Behavior Examples
Low Auto-execute list_directory, read_file, get_device_info
Medium Show diff, require approval write_file, execute_cli, ir_transmit
High Double-tap confirmation delete, subghz_transmit, badusb_execute
Blocked Requires explicit unlock System paths, firmware areas

Input Validation

  • All LLM responses are validated before execution
  • File paths are sanitized to prevent directory traversal
  • JSON from AI models passes through repair and strict parsing
  • BLE data is bounds-checked before processing

Data Protection

  • API keys are stored in Android's EncryptedSharedPreferences
  • Chat history is stored locally in an encrypted Room database
  • No telemetry or analytics are collected
  • No data is sent to third parties (except your chosen LLM provider via OpenRouter)

What We Consider In-Scope

  • Remote code execution
  • Authentication/authorization bypass
  • Data exfiltration or leakage of API keys
  • Prompt injection leading to unauthorized Flipper actions
  • BLE protocol vulnerabilities
  • Path traversal or sandbox escape on the Flipper filesystem

What We Consider Out-of-Scope

  • Social engineering attacks
  • Physical access attacks (someone with your unlocked phone)
  • Denial of service against OpenRouter or other third-party APIs
  • Vulnerabilities in the Flipper Zero firmware itself (report those to Flipper Devices)
  • Issues requiring root/jailbroken Android device

Acknowledgments

We appreciate security researchers who help keep Vesper safe. With your permission, we'll credit you in release notes when a reported vulnerability is fixed.

There aren’t any published security advisories