OxNetLab is a local-first Windows observability tool. By design it:

• binds to 127.0.0.1 (loopback) unless you change OXNET_HOST yourself;
• runs without authentication or TLS — anyone with access to the same Windows user session can call the local API;
• stores telemetry in a local SQLite file (%LOCALAPPDATA%\OxNetLab\ in the portable build);
• sends nothing to third parties (no analytics, no cloud, no outbound product telemetry).

The portable GitHub Release starts in Monitor Mode: mutating HTTP methods (POST, PUT, PATCH, DELETE) are rejected by the backend with HTTP 403 (MONITOR_MODE). Hiding UI controls is not the security boundary.

Do not expose OxNetLab on untrusted networks. If you bind beyond loopback, you do so at your own risk and should put your own authentication proxy in front.

• Local system metrics (CPU, RAM, disks, NIC counters, uptime, process list).
• Probe results for destinations you configure (ICMP, DNS, HTTP).
• Alert records derived from the above.

No credentials, browsing history or file contents are collected.

Only the latest tagged release (v1.2.2 at the time of this writing) receives security attention while the project is active.

Please use GitHub Security Advisories on this repository (Security → Report a vulnerability) for private reports.

Do not open a public Issue with exploit details, secrets or proof-of-concept payloads.

Include: affected version/tag, Windows version, reproduction steps and impact.