Security
A bench tool, not a permanent gateway.
BaudHound is built for a quick session on a serial port, not for leaving wired into anything. Its defaults favour getting connected fast. Read this page before you clip it onto anything that matters.
The device
Open by default, on purpose, and you should know it.
Anyone in range can reach the console, and so read and write whatever UART it is clipped to. Do not use it where integrity, security and confidentiality are required.
Defaults
The access point ships open, with no password. Add one in the firmware before connecting it to anything sensitive.
Plain telnet on port 23 and the web console are unencrypted. Use TLS on port 992 on any network you share.
TLS has no password either: whoever connects first holds the session alone, so nobody can listen in.
Discovery tells anyone on the network that a BaudHound is there. Switch it off in Settings when that matters.
The console
What BaudHoundTerm protects, and what it does not.
Nobody has audited it, and it is provided as is under Apache-2.0. It handles credentials and opens sessions to production equipment, so satisfy yourself that it fits what you point it at.
The design
Secrets are encrypted with DPAPI under your Windows account and never written to the sessions file. DPAPI does not protect against code already running as you.
SSH host keys and TLS certificates are pinned on first use, and a change is refused unless you accept it.
The VNC bridge listens on 127.0.0.1 only, behind a random per-session token.
Builds are not code-signed yet. Check each download against its published SHA-256 before running it.
Best practice: do not save passwords in shortcuts. Type them, look them up in KeePassXC, or use keys.