NetPulse is a local-first Internet observability platform that parses network traffic generated by remote, untrusted entities. We treat security, privacy, and memory safety as first-class architectural requirements.

Please do not open public GitHub issues for security vulnerabilities.

To report a vulnerability privately:

1. Submit a report through GitHub's Private Vulnerability Reporting on this repository.
2. Alternatively, email the maintainers directly.

• A clear description of the vulnerability and its potential impact.
• Reproducible steps, minimal code, or sample PCAP capture file.
• Affected components or crate versions.

We acknowledge receipt of security reports within 72 hours and provide remediation timelines following triage.

NetPulse minimizes its attack surface through three structural boundaries:

┌─────────────────────────────────────────────────────────────────┐
│                    Hostile Input Surface                        │
│             Raw Network Bytes / Untrusted Packets               │
└────────────────────────────────┬────────────────────────────────┘
                                 │
                                 ▼
┌─────────────────────────────────────────────────────────────────┐
│ 1. Parser Isolation Boundary (`netpulse-decode`)                │
│    - Memory-safe Rust parsing                                   │
│    - Zero-copy slicing without arbitrary allocations           │
│    - Isolated continuous fuzz testing (`fuzz/`)                 │
└────────────────────────────────┬────────────────────────────────┘
                                 │
                                 ▼
┌─────────────────────────────────────────────────────────────────┐
│ 2. Storage & Analysis Boundary (`netpulse-engine`)              │
│    - Runs at standard unprivileged user account                 │
│    - Immutable evidence linking for all findings                │
└────────────────────────────────┬────────────────────────────────┘
                                 │
                                 ▼
┌─────────────────────────────────────────────────────────────────┐
│ 3. Single Auditable Egress Boundary (`netpulse-ai`)             │
│    - Outbound connections strictly prohibited everywhere else   │
│    - Opt-in explicit remote AI assistant endpoint               │
└─────────────────────────────────────────────────────────────────┘

1. Observe-Only Guarantee: NetPulse uses passive socket capture techniques. It lacks code paths to drop, inject, modify, or reroute network packets.
2. Parser Isolation & Fuzzing: netpulse-decode processes untrusted packet payloads. It depends only on netpulse-core, forbids unsafe memory manipulations wherever possible, and undergoes continuous fuzzing with cargo-fuzz.
3. Single Egress Boundary: All crates except netpulse-ai are prohibited from creating network sockets or performing HTTP/TCP calls. Verifying data privacy reduces to auditing a single crate.
4. Least-Privilege Separation: Packet capture capability is isolated to netpulse-capture-svc (or netpulse-platform), allowing the main analysis engine (netpulse-engine) and UI shell to execute unprivileged.

Dependencies represent attack surface:

• Dual Cargo Dependency Graphs: NetPulse maintains two independent Cargo dependency graphs:
  • Root Workspace: Cargo.lock (core engine crates & reference plugins)
  • Desktop Shell: src-tauri/Cargo.lock (Tauri desktop GUI shell) Both are independently audited in CI (cargo audit and cargo deny), receive automated Dependabot updates, and must remain committed and reproducible in version control.
• Dependency licenses, bans, and advisories are enforced via deny.toml (cargo-deny).
• Automated vulnerability scanning runs in CI via cargo audit and pnpm audit.
• Advisory Ignore Policy: Security advisory ignore rules (e.g., RUSTSEC-2024-0436) must be documented with an explicit architectural rationale and periodically re-evaluated; they are not permanent passes.
• Dependencies introducing mandatory background telemetry or network calls are strictly disqualified.