We take the security of RemoteLAN seriously. This document outlines our security practices, recent audit findings, and instructions on reporting vulnerabilities responsibly.

If you discover a security vulnerability in RemoteLAN, please do not open a public issue. Instead, report it privately to the maintainers via:

• GitHub Security Advisories: Submit a private advisory report directly on the repository.
• Email: Send vulnerability reports directly to the maintainer team.

Please include:

• A description of the issue and potential impact.
• Step-by-step reproduction steps or proof of concept.
• Affected versions (e.g., v1.4.0).

We will acknowledge receipt of your report within 48 hours, investigate the issue promptly, and release a patch in accordance with semantic versioning.

• Audit Date: September 2026 (Updated for v1.4.0 release)
• Audited Target: RemoteLAN v1.4.0 (src/RemoteLAN, src/RemoteLAN.Protocol, tests/RemoteLAN.Tests)
• Scope: Full repository security sweep (Secrets, Injection, Authentication/Authorization, Privilege Management, Supply Chain).

• Scan Result: 🟢 PASSED
• Automated regex and static analysis detected zero hardcoded secrets, passwords, credentials, or API keys in application sources, configuration files, and test suites.
• All session codes and security tokens are generated dynamically at runtime using cryptographically secure random number generators (System.Security.Cryptography.RandomNumberGenerator).
• Sensitive file patterns (.env, .env.*, settings.json, agent.id, *.id) are properly enforced in .gitignore.

• Scan Result: 🟢 PASSED
• Command Injection:
  • SystemPowerManager executes Windows system commands (shutdown.exe) for remote Lock/Sleep/Restart/Shutdown using structured ProcessStartInfo.ArgumentList (/r, /s, /t, /f, /c), preventing argument injection or delimiter breakout.
  • StartupHelper manages Windows Task Scheduler and PowerShell configuration: hardened all process executions (schtasks.exe, powershell.exe) with structured ProcessStartInfo.ArgumentList to guarantee argument boundary safety without shell concatenation vulnerabilities.
  • Network Protocol Boundary: Incoming wire commands (PowerActionMessage) carry only a strongly typed 1-byte enum (PowerActionType), preventing arbitrary command delivery over the network.
• SQL Injection: Not applicable (no SQL database used; settings are managed via JSON files).
• Cross-Site Scripting (XSS): Not applicable (native WPF desktop client rendering Direct3D/WPF visuals, no web views or innerHTML evaluation).

• Scan Result: 🟢 PASSED
• Cryptographic Randomness: Temporary session PINs are generated using RandomNumberGenerator.GetInt32 across an alphanumeric alphabet (23456789ABCDEFGHJKLMNPQRSTUVWXYZ), avoiding ambiguous characters (0, 1, I, O).
• Timing Attack Prevention:
  • Candidate PINs and unattended passwords in PinManager.ValidatePin are verified using CryptographicOperations.FixedTimeEquals to prevent side-channel timing analysis.
• Brute-Force & Rate Limiting:
  • AgentServer and SettingsManager implement automatic IP lockout: after 5 consecutive failed authentication attempts (configurable), the offending client IP is temporarily locked out for 10 minutes (configurable).
• Session Lifecycle:
  • Sessions are strictly scoped using incrementing generation IDs (_sessionGeneration). Disconnection immediately revokes session privileges and resets hardware input queues.
• Machine Identity & Dynamic IP Defense:
  • Agents generate and persist a persistent cryptographically unique GUID (agent.id). Controllers deduplicate and identify hosts by machine identity rather than transient network IPs, preventing host spoofing and multi-NIC crosstalk.
  • Multi-identifier credential mapping resolves saved credentials across MachineId, MachineName, and IpAddress cross-referenced through DeviceHistory, ensuring credentials cannot be misattributed when DHCP leases change.

• Scan Result: 🟢 PASSED
• RemoteLAN interacts with Winlogon desktops to provide remote assistance during lock screens and UAC prompts.
• RAII Protection: DesktopManager.ImpersonationScope wraps all Win32 ImpersonateLoggedOnUser operations in IDisposable scopes with guaranteed RevertToSelf() in finally blocks.
• All opened process, token, and desktop handles (OpenProcessToken, DuplicateTokenEx, OpenDesktop, OpenInputDesktop) are explicitly closed in dedicated finally blocks (CloseHandle, CloseDesktop).
• Lock Screen Keystroke Safety:
  • DesktopManager.UnlockWithPassword uses non-destructive lock-screen wake (native SendSAS(false) and navigation keys) without emitting destructive cancellation keys (VK_ESCAPE) that disrupt credential providers.
  • Normalizes keystroke entry state (detects and disables active CapsLock via NativeMethods.GetKeyState) prior to sending unlock sequences, preventing password corruption over the Winlogon boundary.

• Scan Result: 🟢 PASSED
• NetworkFrameReader validates incoming length headers: any frame exceeding ProtocolConstants.MaxPayloadSize (20MB) or indicating negative length is rejected immediately with InvalidDataException, dropping the connection and preventing memory exhaustion.

• Scan Result: 🟡 WARNING (Future Hardening Recommended)
• Configuration and credentials (unattended access password and saved remote device passwords) are stored in JSON at %ProgramData%\RemoteLAN\settings.json, partitioned and mapped by persistent Machine GUIDs.
• While the directory location allows seamless background operation across both pre-logon (SYSTEM) and user interactive sessions:
  • Recommendation: Encrypt stored passwords at rest using Windows Data Protection API (DPAPI: ProtectedData.Protect) to safeguard credentials against unauthorized local tools running on the workstation.

• Scan Result: 🟢 PASSED
• Evaluated third-party packages via dotnet list package --vulnerable:
  • System.Drawing.Common (10.0.12)
  • Vortice.Direct3D11 (3.8.3)
  • Vortice.DXGI (3.8.3)
• Dependencies have zero reported vulnerabilities and run against .NET 8 LTS.

• Full test suite passed (111 unit, integration, and regression tests).
• All security hardening modifications tested and verified.