The host runs an HTTP API on port 27889, bound to the LAN. Every endpoint except /ping and the pairing handshake requires a bearer token (compared in constant time); five failed attempts lock the caller out for 60 seconds. The token is generated on first run, stored in the plugin's settings.json, and handed to the Deck only when someone presses Allow on the host's own screen.

The plugin runs with root (Decky flags: ["root"]) because it arms Wake-on-LAN on the NIC and suspends the machine. Anyone who obtains the token can wake, sleep and power off the host — it cannot run arbitrary commands, but treat the token as a password and don't post it in logs or issues.

Please report privately via GitHub Security Advisories rather than a public issue. Include the version, the endpoint or code path, and what an attacker on the same LAN could achieve. I'll acknowledge within a week.

Only the latest release is supported.