Security

• –Served over HTTPS with a publicly trusted certificate; plain HTTP redirects.
• –The session cookie is HttpOnly, Secure and host-only.
• –State-changing requests require a session-bound CSRF token.
• –Your lab is visible only to your own session — another visitor asking for your device gets the same answer as if it never existed.

• –Every device gets its own randomly generated community string. You cannot choose it, and it is not derived from anything guessable.
• –Communities are encrypted at rest with AES-256-GCM.
• –They are shown only to the session that owns the device.
• –They are never written to logs.

SNMP v2c transmits the community string in plaintext. Anyone able to observe the traffic between your monitoring server and this endpoint can read it. Nothing we do at rest changes what the protocol does on the wire.

That is acceptable here because each community grants read-only access to one disposable device that expires within 4 hours. It would not be acceptable for production equipment. Do not reuse a lab community anywhere else.

• –Read-only: SNMP SET is rejected, so nobody can alter a device over SNMP.
• –An unknown community receives no reply at all, rather than an error that could itself be amplified.
• –Inbound SNMP is rate-limited per source and globally.
• –Responses are capped in size to limit reflection and amplification.

Labs and devices expire automatically after 4 hours. Short lifetimes are part of the security model, not just housekeeping: a credential that disappears on its own is one less thing to leak.

If you find a security issue, please stop testing it and report it through the channel you used to reach this service. Please do not run denial-of-service or high-volume probing to demonstrate a finding — the rate limits will simply block you, and it degrades the service for others.