homeio

Homeio runs with a lot of reach into the host: the Docker socket, files under FILES_ROOT, a terminal, disks, network and power. A bug in it can be a bug in the whole machine, so security reports are taken seriously and handled before anything else.

Supported Versions

Fixes land on main and ship in the next release. Only the latest release gets security fixes; there are no backports to older versions.

Version	Supported
Latest release (releases) and ghcr.io/doctor-io/homeio:latest	Yes
Anything older	No — update first, then check whether the issue still reproduces

Reporting a Vulnerability

Please do not open a public issue, discussion or pull request for a security problem.

Report it privately through GitHub:

1. Go to Security → Report a vulnerability.
2. Describe what you found and include:
   • the Homeio version (Settings → General → Homeio Version, or the image tag) and how it is installed (Docker, install script, bare metal);
   • the steps to reproduce, or a proof of concept;
   • what an attacker needs first (network access only, a logged-in session, local shell on the host…);
   • what they get (read files, run commands, take over the host…).

The report stays private between you and the maintainer until a fix is published.

What Happens Next

Homeio is maintained by one person, so these are targets, not guarantees:

• Within 7 days: an acknowledgement that the report arrived.
• Within 14 days: an assessment — whether it is confirmed, how severe it is, and the plan.
• Within 90 days: a fix released, sooner for anything critical.

Once the fix ships, a GitHub Security Advisory is published with the affected and fixed versions, and a CVE is requested when it applies. You are credited in the advisory unless you would rather not be. Please keep the details private until then; if the 90 days run out without a fix, we will agree on a disclosure date together.

Scope

Homeio is built for a single trusted owner on a LAN, a tailnet, or behind a TLS reverse proxy. The full threat model is in doc/security.md. In short:

In scope — for example:

• Anything that works without logging in: auth bypass, session forgery, reaching /api/v1/** or the terminal WebSocket unauthenticated, getting past two-factor authentication.
• Reading or writing outside FILES_ROOT, in the app or in the upload sidecar.
• Cross-site attacks (XSS, CSRF, WebSocket hijacking) that let another site act as the logged-in owner.
• Leaking secrets: AUTH_SESSION_SECRET, password hashes, stored OAuth client secrets or Google Drive tokens.
• Crossing the D-Bus helper or upload sidecar privilege boundary.
• Problems in the install script, the Docker image or docker-compose.yml as shipped.

Out of scope:

• Things the owner can already do on purpose. A logged-in owner can open a shell, run any container, and format disks; that is the product, not a vulnerability.
• Deployments that ignore the documented setup: the default AUTH_SESSION_SECRET left in place, or Homeio exposed to the internet without TLS.
• Denial of service that needs sustained flooding from the local network.
• CVEs in dependencies or the base image without a way to exploit them through Homeio. The published image is already scanned every week; open a normal issue for those.
• Findings from automated scanners with no proof of impact.

When in doubt, report it privately anyway.