registry / signalk-brineomatic-plugin / 1.3.0

signalk-brineomatic-plugin@1.3.0

SignalK plugin for the Brineomatic watermaker controller. Data, control, and remote access.

AI Security Review

scanned 5h ago · by lpm-firewall-ai

At runtime, an enabled board configuration opens a network-reachable reverse proxy to its watermaker controller. This is documented and opt-in, but bypasses SignalK authentication.

Static reason

No blocking static signals were detected.

Trigger

SignalK starts the plugin with enable_proxy enabled for a configured board.

Impact

Users on the boat LAN or VPN trust boundary can access the controller UI; its own login remains the only stated protection.

Mechanism

All-interface HTTP/WebSocket reverse proxy to a configured controller

Rationale

The package is not malicious, but it provides a documented, opt-in capability that can expose a controller UI to the LAN/VPN and disables upstream TLS certificate verification. This is a real dangerous network-control surface warranting a warning.

Evidence

package.jsonsrc/index.jssrc/reverse-proxy.jssrc/signalk-board-proxy.jsREADME.mdsrc/signalk-bus.jspublic/app.js

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

src/reverse-proxy.js binds an HTTP/WebSocket proxy to 0.0.0.0.

signalk-brineomatic-plugin@1.3.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code