API connection first
Normal platform inventory, guests, storage, utilization, and status use a dedicated read-only or narrowly scoped API token. That path installs no Pulse software as root on the Proxmox host.
Production trust · public evidence
Trust boundaries you can inspect.
Pulse is open source, but source availability is only a starting point. This page states the intended privilege model, links claims to code and tests, and gives external reviewers a concrete assessment scope.
No borrowed credibility
Pulse does not currently claim an independent security certification or third-party penetration-test attestation. Public tests and documentation are reproducible engineering evidence. They are not a substitute for an independent assessment.
Least privilege
Start with the smallest trust boundary
The right deployment depends on what you need to observe. Pulse should not ask for host-level authority when a platform API already provides the data.
Privileged agent by choice
Add the root agent where you need SMART data, temperatures, host-local storage, services, Docker, or Kubernetes. Its privilege boundary and hardening options are documented explicitly.
Disabled by default
Installing an agent does not silently authorize remote commands. Command execution is an explicit operator choice and remains bounded by policy, approval, and recorded outcomes.
Read the operational boundary before installing an agent
The agent guide covers root privilege, health-endpoint binding, command modes, guest access, update verification, rollback, and uninstall behavior.
Agent security guideReproducible evidence
Claims with a path back to the test.
These links expose the implementation and regression tests behind the public claims. Reviewers can run the documented commands from a clean checkout and challenge the assumptions directly.
Signed and pinned installation
The server installer pins a requested release and verifies Ed25519-signed release metadata. Agent updates enforce signatures and checksums before executable validation, self-test, and atomic replacement.
Simulated 500-node coverage
The API load suite exercises concurrent resources, metrics history, and mixed endpoints with 500 simulated nodes. The metrics-store integration test covers 500 nodes and 2,000 metric series.
A private path for vulnerabilities
Suspected vulnerabilities should not begin in a public issue. The security policy describes the disclosure process, supported versions, hardening guidance, and the private reporting address.
A scoped invitation, not a badge
The review map covers authentication and tenant isolation, credential storage, agent authority, supply chain, outbound network boundaries, host separation, and scale failure behavior.
External reviewers welcome
Found something I should investigate or want to review Pulse?
Pulse is maintained by one person. Send potential vulnerabilities to me privately. If you want to carry out an independent assessment, tell me which boundary you plan to review and whether the resulting report can be published.