Why should you trust CableProbe?

Trusting the tool

What CableProbe touches on your machine

The 18 probes read system state that is already there — USB devices, descriptors and hub topology; USB-C / Power Delivery port state; block devices and mounts; network interfaces, routing, DNS and listening sockets; input/HID, serial, audio and video devices; PCI / Thunderbolt devices; loaded kernel modules; the process list; and USB-relevant kernel log lines — and it watches udev events live. To do this it reads /sys, /proc and /dev, and runs standard Linux tools (lsusb, lsblk, ip, ss, journalctl, dmesg) as separate, independently installed programs and reads their output. It writes exactly one thing: the JSON report, to the output directory you choose.

Trusting this website

cableprobe.com is a static-feeling PHP site whose only job is to document the project and point you at the real artifacts.

• No third-party requests. No analytics, no tag managers, no tracking pixels, no A/B tools, no web fonts and no CDN. Every asset — CSS, JavaScript, images — is served from cableprobe.com itself. The one script on the site is a small menu toggle.
• No cookies, no accounts, no forms. The site sets no cookies and collects nothing from you. There is nothing to log in to and nothing to submit.
• Locked-down headers. A strict Content-Security-Policy built on default-src 'self' with object-src 'none' and frame-ancestors 'none', plus X-Content-Type-Options: nosniff, X-Frame-Options: DENY, a tight Referrer-Policy, a Permissions-Policy that denies camera, microphone and geolocation, and HTTP Strict Transport Security. HTTPS is forced and all plain-HTTP requests are redirected.
• The site is open source too. It lives in the project repository under the same MIT licence, so you can read or diff exactly what is serving these pages.
• This site is documentation, not the source of truth. Every install instruction points at PyPI or GitHub. If this domain ever disappeared, nothing about CableProbe would change.

Standard web-server access logs (IP, timestamp, requested path, user agent) may be retained for a short period for abuse and reliability purposes. That is the extent of it.

Verifying your download

Install CableProbe only from these sources:

Before you install or upgrade:

• Pin the version and read the release notes and the diff for that tag on GitHub.
• Inspect the package if you want to — it is pure Python: pip download cableprobe --no-deps --no-binary :all: and read the sdist.
• Check release artifacts against the checksums (and, where published, build attestations) attached to the GitHub release.
• Build the Pi image yourself from packaging/pi-gen/ rather than accepting a pre-flashed card from anyone.

# Pin an exact version rather than floating
pipx install cableprobe==0.1.2

# Confirm what you got, offline
cableprobe --version
cableprobe check

Hardening the test host

CableProbe's safety model assumes the machine you run it on is expendable. Hold up your side of that:

• Use a dedicated, disposable Raspberry Pi that holds no sensitive data and no credentials.
• Keep it isolated from any network you care about for the duration of the test.
• Re-flash between cables. Treat the host as burned once a session produces a positive finding.
• Running with sudo lets the kernel-log and udev-attribute probes see more — do that only on the throwaway host, never on a machine that matters.
• Treat every cable under test as hostile hardware from the moment it comes out of the bag.

See the usage documentation for the full session workflow.

Reporting a vulnerability

If you believe you have found a security vulnerability in CableProbe, please report it privately. Do not open a public GitHub issue for security vulnerabilities.

• GitHub private vulnerability reporting — use the “Report a vulnerability” button under the repository's Security tab.
• Email — a monitored security contact address for Stable State Consulting Ltd, published in the repository's SECURITY.md.

Please include:

• a description of the issue and its impact,
• steps to reproduce or a proof of concept,
• affected version(s) or commit hash,
• any suggested remediation.

In scope, for example: code that could cause CableProbe to modify the system under test, unsafe handling of report data, or command injection via crafted device metadata. Not in scope: “CableProbe failed to detect a malicious cable” is not by itself a vulnerability — though improvements to detection coverage are very welcome as normal issues or pull requests.

What to expect from us

• Acknowledgement of your report as soon as reasonably possible.
• An assessment of the issue and, where accepted, a fix or mitigation.
• Credit in the release notes if you would like it.

CableProbe is built and maintained by Stable State Consulting Ltd (www.stablestate.co.uk).