Please report security issues privately through GitHub's security advisories rather than in a public issue. A first reply usually arrives within a few days.

Useful things to include: what you did, what happened, the platform and Python version, and how serious you think it is.

Discovery Now is a discovery and inventory tool for networks you own or are authorized to assess. Knowing its limits is part of using it safely.

It does:

• send ICMP echo requests to the addresses of the subnet it is told to scan;
• open and immediately close TCP connections to a short list of common ports;
• read the operating system's own ARP cache and interface table;
• resolve hostnames through the resolver the machine is already configured with.

It does not:

• authenticate, guess credentials, or attempt any exploitation;
• capture or inspect network traffic;
• change anything on the devices it finds;
• send your inventory anywhere, or fetch anything from the internet. There is no telemetry, no update check and no cloud component.

The interactive menu (discoverynow menu) and the desktop app (discoverynow gui) add nothing to this list. The menu runs the same commands, through the same parser, with the same checks. The app runs the same scan engine and the same guards, on a background thread, and shows desktop notifications through the operating system. Neither sends anything off the machine.

The network map reads one more thing from the operating system: its routing table, to find out which address is the default gateway (ip route on Linux, route print on Windows). It is read, never changed.

• Addresses outside private ranges are refused unless allow_public_ranges is turned on in the configuration, which is a deliberate statement that you are authorized to scan those targets.
• A subnet wider than max_hosts_per_subnet is refused, so a mistyped prefix cannot start millions of probes.
• No administrator or root privileges are required or requested.

The inventory holds MAC addresses, hostnames and IP addresses of devices on your network, which can identify people and their habits. It is stored only in a local SQLite file, whose location discoverynow status prints. Treat it as personal data: do not commit it. discoverynow export writes it out, so use --redact before sharing the result: it hides the unique half of each MAC address and every hostname, label and note.