Security updates are backported to the current release only. If you're on an older version, upgrade to the latest release.

BeeEmUu is a desktop diagnostic tool that communicates with vehicle ECUs over OBD-II / UDS / KWP2000. The following categories are in scope:

Out of scope:

• Physical attacks — someone with physical access to the OBD port can always read/clear codes; this is a property of OBD-II, not BeeEmUu
• Protocol limitations — KWP2000 and UDS have no built-in encryption; we can't fix that at the app level
• Social engineering — convincing a user to clear fault codes is a user education issue, not a software vulnerability

Please do not open a public GitHub issue for security vulnerabilities.

Instead, use GitHub's private vulnerability reporting: https://github.com/ohgeeceee/beemuu/security/advisories/new (or DM the maintainer if you have a private channel). If you don't get a response within 48 hours, ping the public issue tracker with a vague reference and we'll open a private thread.

1. Description — what the vulnerability is and how it could be exploited
2. Reproduction steps — minimal steps to trigger the bug
3. Impact — what data or access could be compromised
4. Suggested fix — if you have one; no pressure
5. Your disclosure preference — coordinated disclosure timeline, or immediate public if you believe users are actively at risk

We prefer coordinated disclosure — we fix the bug, release a patch, and publicly disclose together. If you prefer a different timeline, tell us and we'll try to accommodate.

• CI builds run on GitHub-hosted runners (not local machines)
• Release binaries are built from tagged commits with reproducible steps
• No binary blobs or precompiled dependencies checked into the repo

Dependabot alerts on transitive dependencies are triaged against whether the affected code is reachable from this app, not just whether the crate appears in the lockfile. Dismissals are recorded here so the reasoning is auditable.

• GHSA-wrw7-89jp-8q8g (glib, medium) — dismissed, not used. glib 0.18.5 arrives only through the Linux GUI stack (tauri → gtk 0.18 → muda / tao / webkit2gtk-rs / wry); nothing under src-tauri/src uses glib directly. The advisory covers unsoundness in the Iterator / DoubleEndedIterator impls for glib::VariantStrIter, which the app never constructs or iterates. The patched version is 0.20.0, but gtk 0.18.2 requires glib = "^0.18" — confirmed with cargo update -p glib --precise 0.20.0, which fails to select a version — so the fix is unreachable until Tauri moves its Linux stack to gtk-rs 0.20. The alert should clear on its own at that point.

  The upgrade path, checked against crates.io on 2026-10-06: glib 0.20+ exists (0.22.10 is current) and gtk 0.19.0 requires glib ^0.22, so moving the GTK stack one minor version would clear the advisory. What blocks it is webkit2gtk — the crate Tauri's Linux backend builds against. Its newest release (2.0.2) still requires gtk ^0.18, and tauri depends on webkit2gtk = "^2.0", so the resolver cannot pick a GTK 0.19. The block is upstream in webkit2gtk-rs, not in this repo: once it publishes a release on gtk 0.19+, an ordinary cargo update resolves the alert with no code change here. Until then the only alternatives are a fork or vendoring, which is not worth it for a GUI-stack type the app never calls.

• No telemetry, analytics, or remote logging
• No cloud sync (unless user explicitly exports a file)
• Log files and CSV exports stay on the user's machine
• VIN is read from the car but never transmitted off-device

• All OBD/UDS/KWP2000 traffic is local (USB/ENET cable, no internet)
• DTC wiring schematics are fetched on demand via read-only HTTPS GETs to https://api.beemuu.com/api/dtc/<code>/schematics (5 s timeout; only the DTC code is sent — no VIN or other vehicle data). No other remote diagnostic server or API calls.
• SecurityAccess (0x27) seed/key algorithms are pluggable but don't ship proprietary BMW keys

• Content Security Policy (src-tauri/tauri.conf.json): default-src 'self'; scripts only from the app bundle and https://cdnjs.cloudflare.com (Chart.js — the single external script origin); connect-src 'self' ipc: http://ipc.localhost (Tauri IPC only — the webview makes no network requests of its own; the schematics fetch above happens in Rust); img-src 'self' data:; object-src 'none'; base-uri 'none'; form-action 'none'. The one exception is style-src 'unsafe-inline', scoped to style only: three renderers set numeric/computed values through style="" attributes (watch-byte bars, log-channel swatches). There is no unsafe-inline for script.
• Command exposure: the webview can invoke every app command via Tauri IPC (window.__TAURI__.core.invoke, withGlobalTauri: true). Tauri v2 capabilities gate plugin/core commands and remote origins, but cannot distinguish app code from injected code inside the same local window — so the injection boundary is output encoding, not the IPC handle:
  • Community-controlled strings (DTC texts, profiles, Oracle / Story / Opinions content, load warnings), vehicle-derived strings (VIN, module names, fault texts, freeze frames), hosted-API fields, and Rust error strings are HTML-escaped at every innerHTML sink in src/js/main.js.
  • No inline event handlers (onclick=) are generated anywhere; dynamic UI is wired with addEventListener, which is what keeps script-src free of unsafe-inline.
• Mutex poisoning: commands share state behind std::sync::Mutex. Every lock acquisition in commands.rs propagates a poisoned lock as a command error (state lock poisoned: ...) instead of panicking, so one panicking command cannot cascade into all others. The Tester Present keep-alive worker already exits cleanly on poison.

(No reported vulnerabilities yet. Be the first to get your name here.)

We thank the following security researchers for responsibly disclosing vulnerabilities:

(List will be updated as reports come in.)

This policy is adapted from the GitHub Security Lab template and is licensed under CC0.