Minimum claimable baseline
Required governance, firmware, identity, channel, administration, MQTT, privacy, and response controls.
Public review draft · v0.1
Meshtastic security,
made assessable.
An independent, evidence-led baseline for organizations operating Meshtastic fleets. It defines minimum controls, acceptable evidence, stop conditions, and the limits of any conformance claim.
Independent publication. No certification or Meshtastic project endorsement.
What it establishes
A control system, not a security badge.
Core conformance requires every applicable Core control to pass, no Core control to remain untested, and no stop condition to be present. A percentage score cannot override a stop condition.
Higher-impact operations
Additional lifecycle, provenance, monitoring, physical protection, and application-layer safeguards.
Control catalog
Nine domains.
One evidence model.
The canonical PDF contains every normative control, minimum evidence requirement, and source basis.
Governance and scope
Fleet boundaries, accountable owners, and controlled exceptions.
Asset and firmware integrity
Inventory, supported releases, staged updates, and firmware provenance.
Device identity and keys
Per-device identities, uniqueness checks, enrollment, response, and recovery.
Channels and message trust
Private channel keys, membership, sender limitations, and rotation.
Administration and interfaces
PKC administration, managed mode, Bluetooth, serial, WiFi, and Ethernet.
MQTT and internet gateways
TLS, credentials, ACLs, payload policy, downlink control, and monitoring.
Network, client, and physical
Controlled network paths, operator endpoints, and unattended nodes.
Privacy and minimization
Position precision, map reporting, metadata exposure, and approvals.
Monitoring and response
Configuration drift, identity changes, incident procedures, and recovery tests.
Core stop conditions
Some failures end the conformance discussion.
No compensating percentage or aggregate score can erase these conditions.
- 01Duplicate device identity keys in the assessed fleet.
- 02A public, default, simple, or unencrypted key carrying confidential or operational traffic.
- 03Unsupported firmware without an approved, time-bounded exception and compensating controls.
- 04Legacy administrative channel control retained on current nodes outside an approved migration.
- 05Internet-reachable MQTT downlink without required TLS, authentication, least-privilege ACLs, and approval.
- 06Known exposure of device keys, channel keys, broker credentials, or administrator keys without completed containment and rotation.
Evidence language
Unknown never becomes pass.
Every conclusion must retain its evidence state and tested boundary.
Observed
Directly present in scoped configuration, records, or logs.
Verified
Reproduced or corroborated beyond the originating assertion.
Inferred
Reasoned from observations with the logic and limits stated.
Assumed
A working premise that remains unestablished.
Unknown
Evidence was unavailable, inaccessible, or outside scope.
Public review
Challenge a control with evidence.
The v0.1 review window closes October 1, 2026. Identify the control ID, disputed behavior, deployment context, authoritative evidence, and proposed replacement language.
Submit baseline feedbackMaintenance commitment
MeshProof Forge will recheck upstream support, stable releases, advisories, and trademark guidance at least monthly while v0.1 is current.
- Scheduled review: September 20, 2026
- Material upstream changes can trigger an earlier revision
- Superseded editions will remain archived
- Each assessment rechecks mutable facts independently
Canonical files
Verify what you downloaded.
The hashes below identify the current public review files published from this page.
MeshProof Meshtastic Security Baseline v0.1
c9dd98ed769994f4c93a3577f5d62af297cf35143ed00b90adbe8c6fdf3640baDownload canonical PDF ↓Sample Meshtastic Fleet Security Assessment
7ceb711be91b1acbf91a0ff03978bc6ee1cb380d08f2d2f2ccaca67cef002561Download sample assessment ↓MeshProof Device Batch Pilot Scope
30bdb87c1b774fad8b27cab97cbac0e1b425e1fbe5b1790a5a85d7f0163460dcDownload pilot scope ↓Publication terms
Copyright 2026 Red Asgard. All rights reserved. Short excerpts may be quoted with attribution and a link to this canonical page. Redistribution, translation, modification, or publication of derivative editions requires written permission. Do not represent modified copies as MeshProof publications.