The security of FleetPilot and the systems it manages is taken seriously. If you discover a vulnerability, please follow responsible disclosure practices.

Do not open a public GitHub issue for security reports. Public disclosure before a fix is available puts all users at risk.

Instead, please report vulnerabilities through one of the following channels:

• GitHub Private Vulnerability Reporting — use the Security tab of this repository to submit a private advisory directly to the maintainers.
• Email — contact the maintainers directly if a private advisory is not suitable for your report.

A useful report should include the following information:

We aim to acknowledge all security reports within 48 hours and to release a fix or mitigation for critical issues as quickly as possible. You will be credited in the release notes unless you prefer to remain anonymous.

FleetPilot follows a rolling release model. Security fixes are applied exclusively to the latest version. We strongly recommend always running the most recent commit from the main branch.

FleetPilot implements the following security controls by default:

The controls listed above protect the application itself. The following steps are your responsibility as the operator and are required before any production deployment.

Never rely on default credentials. Configure the following variables in a .env file with restricted permissions:

# Restrict file permissions immediately
chmod 600 .env

# Generate a cryptographically secure session key
export SECRET_KEY=$(openssl rand -hex 32)

# Set a strong, unique admin username and password
export DASHBOARD_USERNAME=your_admin_username
export DASHBOARD_PASSWORD=your_strong_password

# Ensure debug mode is explicitly disabled
export FLASK_DEBUG=false

Never expose FleetPilot over plain HTTP. Without TLS, session cookies, login credentials, and SSH passwords entered through the UI are transmitted in clear text and are trivially interceptable.

Deploy FleetPilot behind a TLS-terminating reverse proxy such as Nginx, Caddy, or Traefik. Caddy is recommended for automatic certificate management via Let's Encrypt:

fleetpilot.internal {
    reverse_proxy 127.0.0.1:5000
}

Additionally, set the following Flask configuration to enforce secure cookies over HTTPS:

export SESSION_COOKIE_SECURE=true
export SESSION_COOKIE_HTTPONLY=true
export SESSION_COOKIE_SAMESITE=Lax

FleetPilot is an administrative tool and must not be reachable from the public internet. Restrict access at the network level:

• Bind the application to 127.0.0.1 only and let the reverse proxy handle external connections.
• Require a VPN connection (e.g., WireGuard, Tailscale) to reach the management interface.
• Use firewall rules (ufw, iptables, or a network-level ACL) to allow access only from trusted management hosts or subnets.

FleetPilot can also enforce this itself: System → Security center → Allowed networks accepts addresses and CIDR ranges. The server itself and the public status page are always reachable. Behind a reverse proxy, set FLEETPILOT_TRUST_PROXY=true so FleetPilot sees real client addresses.

Flask's built-in development server is single-threaded, not hardened, and not suitable for production. Use Gunicorn or uWSGI instead:

gunicorn --bind 127.0.0.1:5000 --workers 4 --timeout 120 app:app

For a persistent deployment, manage the process with systemd or a container runtime.

Disk management features require sudo or root access, which significantly expands the blast radius of any vulnerability. Mitigate this risk by:

• Running FleetPilot on a dedicated, isolated management node — not on a general-purpose server.
• Configuring /etc/sudoers to grant passwordless execution only for the specific utilities required (e.g., smartctl, mkfs.*, wipefs, badblocks), rather than granting unrestricted sudo access.
• Running the application inside a VM or container to limit the impact of a potential compromise.

By default, the SSH client uses AutoAddPolicy, which accepts any host key on first connection. This is acceptable for initial setup but is vulnerable to Man-in-the-Middle (MitM) attacks in a production environment.

To harden SSH connectivity:

• Pre-populate the ~/.ssh/known_hosts file on the FleetPilot server by connecting to each managed host manually once.
• Change AutoAddPolicy to paramiko.WarningPolicy or paramiko.RejectPolicy in the SSH client configuration within app.py.
• Protect the ~/.ssh/ directory on the FleetPilot server with strict permissions (chmod 700 ~/.ssh).

For government, defence, finance, healthcare and other regulated sites. These settings map to NIST SP 800-53 / 800-63B, BSI IT-Grundschutz and TR-02102, DISA STIG and FIPS 140-3. FleetPilot itself is not certified; an accredited assessment of the complete installation is still required.

1. Sandbox the service: install deploy/fleetpilot-strict.conf as /etc/systemd/system/fleetpilot.service.d/strict.conf. It removes sudo (local disk formatting and local fan control are then unavailable), enables a system-call filter and restricts network targets to private ranges. systemd-analyze security fleetpilot drops from 5.8 to 1.2.
2. TLS: use deploy/nginx-fleetpilot-tls.conf (TLS 1.2/1.3, forward-secret AEAD suites, HSTS) with a certificate from your internal CA.
3. Environment (/opt/fleetpilot/.env): FLEETPILOT_FIPS=true on FIPS-enabled systems, FLEETPILOT_SSH_STRICT_HOST_KEYS=true after loading all managed hosts into known_hosts, FLEETPILOT_OFFLINE=true in air-gapped networks. No page loads anything from third parties; fonts, Bootstrap and Chart.js are served by FleetPilot.
4. System → Security center: require 2FA for administrators, add the system-use notice, set lockout to 3 attempts / 15 minutes, idle timeout 15 minutes, session lifetime 12 hours, allowed networks, and keep audit events for your retention period.
5. Audit forwarding: every audit event is also logged as JSON by the fleetpilot.audit logger (journald). Forward the journal to your SIEM so records exist outside FleetPilot. The audit trail inside FleetPilot is HMAC-chained; the Security center reports any changed or removed event.

The following security gaps are acknowledged. Contributions to address them are welcome.

Before going live, verify each of the following:

• SECRET_KEY is a random value of at least 32 bytes and is not committed to version control
• DASHBOARD_USERNAME and DASHBOARD_PASSWORD have been changed from their defaults
• FLASK_DEBUG is set to false
• .env file permissions are set to 600
• HTTPS/TLS is enforced via a reverse proxy
• SESSION_COOKIE_SECURE, SESSION_COOKIE_HTTPONLY, and SESSION_COOKIE_SAMESITE are configured
• The application port is not directly reachable from untrusted networks
• VPN or network-level access control is in place
• A production WSGI server (Gunicorn / uWSGI) is used
• sudo access is scoped to specific disk utilities only
• SSH known_hosts is pre-populated for all managed hosts
• Dependency updates are scheduled regularly
• Backups of hosts.json, users.db, and update_settings.json are configured
• Monitoring and alerting are configured for the host system
• System → Security center shows no red checks
• Every administrator uses two-factor sign-in, and "Require 2FA for administrators" is on
• A notification channel receives security events (lockouts, new admins)

FleetPilot depends on several third-party libraries. Monitor the following security advisory feeds to stay informed of upstream vulnerabilities:

• Flask — github.com/pallets/flask/security
• Paramiko — github.com/paramiko/paramiko/security
• APScheduler — github.com/agronholm/apscheduler/security
• Werkzeug — github.com/pallets/werkzeug/security

To update all dependencies:

pip install --upgrade -r requirements.txt

Consider pinning dependency versions in requirements.txt and enabling Dependabot to receive automated pull requests for security updates.

FleetPilot requires elevated system privileges for disk management operations. This inherently carries risk. The software is provided for use in trusted, isolated environments only. The maintainers accept no liability for damage, data loss, or security incidents resulting from its deployment or misuse.