platecli controls 3D printers over your local network and downloads untrusted model files from the internet. Both are security-sensitive, so this document explains the threat model, the mitigations already in place, known limitations, and how to report a vulnerability.

Please do not open a public issue for security problems.

Report privately through GitHub's private vulnerability reporting on this repository (Security → Report a vulnerability). If that is unavailable, open a normal issue that says only "security report — please open a private channel" without any details, and a maintainer will follow up.

Please include, where possible:

• affected version (plate --version) and platform,
• a description of the issue and its impact,
• reproduction steps or a proof of concept,
• any known workaround.

You can expect an initial acknowledgement within a few days. Because this is a small volunteer project there is no formal SLA, but confirmed issues will be fixed as a priority and disclosed once a fix is available. Coordinated disclosure is appreciated.

The project is pre-1.0 and under active development. Security fixes are made against main and land in the next tagged release; there is no long-term support branch for older versions. Always run the latest release.

The tool is designed to run fully locally — there is no cloud account, and no telemetry or data leaves your machine except (a) LAN traffic to your printer and (b) explicit model downloads you request. Key properties:

• Printer TLS. Bambu printers present a self-signed certificate over MQTTS and FTPS. Pin it with cert_fingerprint (SHA-256), which plate setup / doctor can capture for you. When a fingerprint is set and does not match, the connection is refused on MQTT, FTPS (control + data channel), and the direct camera path. All three transports verify through one shared checker (bambu_cli.tlspin.verify_cert_fingerprint, constant-time compare on normalized hex) so there is a single, audited fail-closed code path rather than three hand-written copies. insecure_tls: true disables verification entirely and exists only as a last resort — it is never the default and the CLI warns when it is used.
  • Camera (port 6000): the direct grab refuses to proceed if neither pin nor insecure_tls is set. Note that snapshot then falls back to the Docker streamer, which does not honour the pin, so the command as a whole is not fail-closed by default — set camera_direct_only: true to refuse that fallback (see Known limitations).
  • MQTT / FTPS without a pin: use system CA verification (CERT_REQUIRED), which fails for typical Bambu self-signed certs (effective fail-closed). Prefer an explicit pin for clear errors and uniform policy.
• Access codes are secrets. Store the printer access code in a separate file via access_code_file (the recommended path) rather than inline in config.json. Inline access_code still works for legacy configs but is deprecated; migrate with plate setup --migrate-access-code. config show redacts the access code. On POSIX, config and access-code files are tightened toward 0600 on load.
• Downloads are SSRF-hardened. URL fetches (including Printables) resolve and validate targets before connecting to block requests to private/loopback address ranges (unless --allow-private-ips, which is CLI-only and never sticky config), disable environment proxies, cap redirect hops, and enforce a size cap (2048 MB by default, --max-download-mb).
• Archive extraction is path-traversal safe. ZIPs are extracted without allowing entries to escape the destination directory; symlinks are skipped; existing files are never overwritten (a numbered sibling such as model-1.stl is created instead).
• Printing and other physical/destructive actions require explicit intent. Physical print start, stop, pause, resume, delete, and raw gcode will not proceed without --confirm (they refuse with exit code 5). job / send without --confirm still runs download → slice → upload and exits 0 with "status": "uploaded_not_printed"; only the print step is withheld. --confirm is a deliberate-action gate against accidents, not an authorization boundary: the CLI cannot distinguish a human's flag from an agent's. Agents must not invent confirm flags without user approval.

Documented residuals from the threat model and the 2026-07 security audit. Tracked for hardening; not all are “bugs” in the sense of broken claims.

In scope: the bambu_cli package and its published wheels/sdist, the CLI surface, download/extraction handling, and the printer transport layer.

Out of scope: vulnerabilities in third-party dependencies (report those upstream), OrcaSlicer itself, the printer firmware, and issues that require an already-compromised local machine or a malicious printer on your own LAN (beyond what pin/insecure_tls policy can mitigate).

• AGENTS.md — agent safety checklist
• docs/quality-roadmap.md — security scoreboard
• docs/api.md — agent JSON contracts