This project is pre-1.0 and under active development. Security fixes are applied to the main branch only.

Please do not open a public issue for security problems.

Report privately to g.akashvarma@gmail.com, or use GitHub's private vulnerability reporting.

Include: a description, affected files/versions, reproduction steps, and impact. You can expect an initial acknowledgement within a few days.

This is a simulator that generates synthetic telemetry, but it connects to real transports — keep these in mind:

• MQTT is TLS-only. MqttAdapter connects over mqtts with rejectUnauthorized: true. AWS IoT Core certificate auth is supported via connection.awsIot (paths to cert/key/root-CA).
• Never commit secrets or certificates. Endpoints and tokens are read from the environment / a local .env (both git-ignored), and certs/ is git-ignored. Do not hardcode credentials in a config file.
• The dashboard has no authentication. The embedded HTTP/SSE dashboard and its REST API bind to the configured host/port (default localhost:3000). Do not expose it to an untrusted network without putting your own authentication/proxy in front of it.
• Treat the broker/endpoint as sensitive. The simulator will happily publish to whatever endpoint you configure — point it only at brokers you control.

Reports about the framework and the bundled quarry plugin are in scope. Advisories originating purely from third-party transitive dependencies (surfaced by npm audit) are tracked separately as part of dependency maintenance.