You download and run the Helios Local Agent binary on any device connected to your home network. It binds to localhost only — no inbound ports are opened.

The agent sends ARP requests across your subnet (e.g. 192.168.1.0/24). Responses reveal which IP addresses are active and their MAC addresses. This traffic never leaves your LAN — it is a Layer 2 broadcast that routers do not forward.

For each discovered device, the agent probes common ports (22, 23, 80, 443, 445, 3389, 5555, 8080, 8443, 1883…). Open ports are recorded. Service banners (HTTP headers, SSH version strings) are read to identify firmware and OS. All of this happens on your local network — no data is sent anywhere yet.

The agent ships with a bundled copy of the IEEE OUI database (~6 MB). Vendor names are resolved entirely offline — no external DNS or API call is made. Your device MAC addresses never leave your machine.

The agent applies a local rule engine to the collected data: open Telnet (port 23) → critical; ADB over Wi-Fi (port 5555) → medium; RDP exposed (port 3389) → high; etc. Scores and findings are computed in memory on your machine.

Before any data leaves your machine, the agent encrypts the full scan payload using AES-256-GCM. The encryption key is derived from your Helios session token using HKDF-SHA256. The server never sees the plaintext — it only ever stores the ciphertext blob.

The encrypted blob is POSTed to /api/scan/upload with your X-Helios-Token header. The server validates your session, stores the ciphertext in the database under your tenant_id, and returns a scan ID. It cannot read the contents.

Your browser fetches the ciphertext, derives the same AES-256-GCM key from your session token, decrypts the payload in memory using the Web Crypto API, and renders the dashboard. Plaintext exists only in your browser's JavaScript heap — never on disk, never in logs.

Helios server is compromised

Server only holds AES-256-GCM ciphertext. Without your session-derived key, the data is computationally indistinguishable from random bytes.

Network eavesdropping (MITM on upload)

All API traffic uses TLS 1.3. The payload is also AES-256-GCM encrypted before transmission — double-encrypted in transit.

Another user on your Helios account sees your scan

Multi-tenant isolation: every scan is stored under your tenant_id. enforceTenantIsolation middleware blocks cross-tenant reads at the API layer.

Agent binary is tampered with

Releases are signed with a Helios code-signing certificate. SHA-256 checksums are published. The install script verifies the signature before executing.

Malware on your machine reads scan results from memory

This is outside our threat model — if your machine is compromised, all bets are off. We recommend running the agent on a dedicated Raspberry Pi on a separate VLAN.

Scan data persists in browser after session ends

Decrypted scan data is held only in React state (JavaScript heap). It is never written to localStorage, IndexedDB, or sessionStorage. Closing the tab clears it.