zbctl changes network and service state as root, so security reports are welcome.

Report privately: use GitHub's Security → Report a vulnerability on this repository. Please do not open a public issue for anything exploitable. You can expect an acknowledgement within a few days.

• Changes require root; read-only commands do not. No remote interface, no network listener.
• Commands are executed as argv arrays (never through a shell) and only from a fixed allowlist (ip, nmcli, systemctl, journalctl, ping, scontrol, plus read-only diagnostics helpers).
• Configuration is strictly validated; unit/interface names are pattern-checked before use.
• There is no force/bypass option for mode transitions.
• Audit lines and diagnostics redact secret-looking values; raw command output is never written to the audit log.
• The state file is a record, not evidence: decisions use the observed system state.

Supported versions: the latest 0.x release only (alpha software).