BluePy is an infrastructure security scanner. Because it connects to your servers with credentials, please treat it (and reports about it) with care.
BluePy is in alpha. Security fixes are applied to the latest main and the
most recent tagged release only. There are no long-term support branches yet.
| Version | Supported |
|---|---|
latest main / latest tag |
✅ |
| older tags | ❌ |
Please report security issues privately, not in public issues:
- Preferred: open a GitHub Security Advisory ("Report a vulnerability") on the repository.
- If that is unavailable, open a minimal public issue asking a maintainer to open a private channel — do not include exploit details in the public issue.
When reporting, include: affected version/commit, environment, reproduction steps, and impact. Please give maintainers a reasonable window to respond before any public disclosure. As a volunteer alpha project we cannot commit to a fixed SLA, but we aim to acknowledge reports promptly and coordinate a fix and disclosure timeline with you.
- Transport security: SSH host-key verification is strict by default.
The
--insecureflag disables it for a single run (with a warning) and exposes you to man-in-the-middle attacks — use it only against disposable lab hosts. - Credentials: BluePy reads credentials from CLI arguments. Avoid passing
secrets on shared shells; prefer key-based auth (
--key). - Remediation: automatic remediation mutates remote systems. It is not exposed in v0.1 and is out of scope for this policy until it ships behind an explicit, reviewed interface.
- Check correctness: in v0.1 only the verified check set (see README) is trusted. Experimental checks are unverified and must not be relied on for compliance decisions; correctness gaps in experimental checks are tracked as normal issues, not security vulnerabilities.
- Findings produced by
--include-experimentalchecks (known to be unreliable). - Vulnerabilities that require
--insecureto exploit (documented footgun).