🔒 Netfox 0.13.0 — the endpoint that refuses to be careless
🔒 Netfox 0.13.0 — the endpoint that refuses to be careless
Netfox can expose a read-only metrics endpoint, so your own monitoring can scrape your network. Handy — and, it turns out, far too easy to leave wide open.
Switch on "allow access from other devices" without setting a token and that endpoint was reachable from anywhere on your network with no authentication at all. What it serves is your entire device inventory: every IP, every MAC address, every hostname, every open port. 😬
That's fixed, and it's the kind of fix I'd rather tell you about than quietly bury in a changelog.
🚫 It fails closed. No token, no network endpoint. Netfox refuses to start it and tells you exactly why, right where you turned it on — instead of serving your LAN to the room and hoping you noticed the help text.
Settings → Integrations, where the endpoint now explains itself
🔑 Your token is treated like a secret. It lives in your keychain now, not in a preferences file, and the field hides it as you type — so it stops appearing on screen during a demo or a screen share. An existing token moves across automatically; you don't re-enter anything.
⏱️ Constant-time token checks, because how long a rejection takes shouldn't hint at how close a guess was.
If you scrape the endpoint over your network: set a token after updating and it starts right back up. Localhost-only setups — what almost everyone runs — are untouched and still need no token.
⌨️ And the part you asked for: the built-in web viewer's address bar is editable. Jump straight to /admin, try another port, flip http↔https — no more closing the window and starting over just to reach a different page.
A device's own web interface, rendered inside Netfox
🎯 The host stays locked to the device you're inspecting. That's the whole point of the viewer, so it isn't editable: type a different address and Netfox tells you it's locked here rather than following you off-device.
Changing the port re-points the lock instead of loosening it, and keeps your current path.
Free, native, notarized. macOS 15+. No account, no telemetry, nothing leaves your Mac on its own.
👉 Try it / see what's new: https://netfox.app
If you run Netfox alongside Prometheus or Grafana, I'd love to hear how you've wired it up — and what you'd want the viewer to reach next 👀
Replies
Failing closed by default is such a smart choice. It's one of those security decisions people only notice when it saves them from a mistake.
Netfox
@amard_sonal exactly — fail closed is the kind of thing thats invisible until the day it saves you. and thats the whole point right, security defaults shouldnt rely on someone reading the help text 😅 the old behavior (serving your whole LAN inventory with no auth) just felt wrong to leave as the default. appreciate you noticing 🙏
Buffup.AI
The editable address bar is a nice quality-of-life improvement. What feature request has been the most consistent from power users that still isn't on the roadmap yet?
Netfox
@sansa_grey good q! honestly the most consistent one is exporting/alerting on network changes — like “ping me when a new device shows up on the LAN” or a webhook when a port opens. its been asked a bunch and it keeps sliding down the list because doing it well (without turning netfox into a noisy nagging thing) is trickier than it sounds.
the editable address bar was actually a smaller ask but way easier to ship, so it jumped the queue lol. curious if the change-alerting thing is what youd want too, or something else?