Skip to content

Security: shadow-x78/orbiscreen

Security

SECURITY.md

Security Policy - Orbiscreen

Applies to v0.10.2 and later.

📋 Table of Contents

🛡️ Supported Versions

Version Supported
0.10.x ✅ Active development
0.9.x ⚠️ Maintenance
0.8.x ⚠️ Maintenance
< 0.8 ❌ Not released

Only the latest minor release receives security updates. Ensure you build from main before reporting.

🚨 Reporting a Vulnerability

If you discover a security vulnerability in Orbiscreen, please report it responsibly and privately.

Preferred method:

Alternative method:

  • Email the maintainers via the GitHub security contact above.

What to include:

Field Details
Description Clear explanation of the vulnerability
Reproduction Steps to reproduce - minimal PoC if possible
Component Affected crate / module and version
Impact Privilege escalation, input injection, data exposure, etc.
Fix Suggested mitigation (optional)

Response timeline:

Phase Timeframe
Initial acknowledgment Within 72 hours
Impact assessment Within 7 days
Patch development Within 30 days (critical)
Public disclosure Coordinated after fix is released

📢 Disclosure Policy

We follow a coordinated disclosure model:

  1. Report received and acknowledged
  2. Vulnerability validated and severity assessed
  3. Fix developed and tested
  4. Patch released to all supported versions
  5. Public disclosure with credit to reporter (if desired)

No premature disclosure. Do not open public issues or pull requests for security bugs until the fix is released.

🔍 Security Considerations

Scope (v0.10.2)

Orbiscreen is a Linux host daemon plus a Material 3 Android client that:

  • Creates kernel-level virtual displays via the evdi DRM module
  • Captures screen contents via X11 (x11rb) or Wayland (ashpd + PipeWire)
  • Injects input events via evdevil (uinput) or ashpd RemoteDesktop
  • Streams MPEG-TS/H.264 over a plain HTTP endpoint (/stream) — WebRTC is no longer used for the Android client
  • Exposes a control-plane HTTP API at /api/control (lock, blank, ctrl-alt-del, open)
  • Exposes /api/info with the host's display resolution, encoder, and version

Known Risk Areas

Area Risk Mitigation
uinput injection Any process holding the virtual touchscreen can inject arbitrary input The daemon opens the uinput device exclusively; restrict /dev/uinput permissions on the host
Screen capture Frames contain everything rendered to the virtual display v0.10 binds to the evdi-backed virtual display only, not the primary desktop
Cleartext HTTP /stream A LAN attacker can passively view the desktop orbiscreen only binds on 127.0.0.1 by default; the LAN case is opt-in via adb reverse or LAN bind in the config
/api/control A LAN attacker can call lock/blank/open The endpoint is unauthenticated by design; treat 0.0.0.0 bind as LAN-only
evdi kernel module DKMS + Secure Boot signing is distro-specific Module loading is the host administrator's responsibility
mDNS advertising (_orbiscreen._tcp.) Hostname + port broadcast on the local network No credentials are advertised; the discovery record only contains host, port, and the instance name
Android input model (v0.10.2) InputDispatcher posts absolute pointer / wheel / stylus / keyboard events to /input The endpoint is the same one used historically; restrict access at the network layer

Recommendations

  1. Run the daemon as a non-root user with explicit /dev/uinput + /dev/dri/card* permissions via udev rules.

  2. Do not expose the signaling port (8788 by default) to untrusted networks. Bind to 127.0.0.1 and use adb reverse for USB transport on untrusted networks.

  3. Build from source from the official repository:

    git clone https://github.com/shadow-x78/orbiscreen.git

  4. Review the evdi kernel module provenance before loading it; Secure Boot hosts must sign it.

  5. Never log raw input events in production - tracing is set to INFO by default and does not dump pointer coordinates. The Android InputDispatcher similarly does not log coordinates in release builds.

  6. Verify package signatures before installing. See docs/PACKAGING.md for the GPG / keystore fingerprints.

🔬 Security Audit

Orbiscreen (v0.10.2) is written in Rust (edition 2021) plus a Kotlin Android client (Material 3 + Jetpack Compose). A running daemon performs:

  • open() on /dev/dri/card* evdi nodes
  • UinputDevice construction via evdevil
  • GetImage (X11) or Screencast portal (Wayland) capture
  • GStreamer pipeline construction for H.264 encoding
  • axum HTTP listener on the configured signaling port, serving /stream, /health, /api/info, /input, /api/control
  • adb reverse subprocess invocation when a USB device is attached
  • NsdManager.discoverServices on the Android client (no outbound traffic outside the LAN)

All logic is readable in plain Rust and Kotlin. If you perform an audit, please share findings via the private reporting channels above.

🏆 Hall of Fame

We thank the following security researchers for responsible disclosure:

(None yet - be the first!)

Built by shadow-x78 · orbiscreen · Back to README

© 2026 Orbiscreen (shadow-x78)

There aren't any published security advisories