# Security

This project intentionally keeps almost all functionality unprivileged.

## Privileged operation

Only `chvt` requires root privileges. The recommended sudoers rule is limited to:

```text
/usr/bin/chvt
```

or, when the machine uses fixed VTs, to explicit arguments such as:

```text
/usr/bin/chvt 1
/usr/bin/chvt 2
```

Do not configure unrestricted passwordless sudo for the user or for the recovery scripts.

## Non-interactive sudo

The recovery script always invokes sudo with `-n`:

```bash
sudo -n /usr/bin/chvt ...
```

This prevents the systemd user service from hanging on a password prompt.

## Boot safety

DRM hotplug events can occur during boot. The watcher therefore verifies that the current user has an active Wayland session with a valid VT before any recovery or VT switch is attempted.

## Reporting security issues

If this repository is published publicly, report security-sensitive findings privately through the repository owner's preferred security contact rather than opening a public issue containing exploitable details.