Skip to content

Security: hurmsh/bluetooth-refresh

Security

SECURITY.md

Security

What the app does

Bluetooth Refresh invokes the Windows inbox command:

%SystemRoot%\System32\pnputil.exe /scan-devices

This asks Windows to rescan Plug and Play hardware. Windows may then notice a Bluetooth adapter or device-state change. The app also opens the official ms-settings:bluetooth Settings page when asked.

What the app does not do

  • It does not disable or enable devices.
  • It does not restart Bluetooth services.
  • It does not install, remove, or update drivers.
  • It does not delete pairings.
  • It does not create a service, scheduled task, startup entry, or other persistence.
  • It does not collect telemetry or make network requests.
  • It does not store credentials or personal information.

The main app uses the Windows asInvoker execution level. It first runs the rescan without elevation. Only if Windows returns an elevation-required or access-denied result does the app offer the standard one-time UAC prompt for a short-lived copy of itself that performs the same rescan and exits.

Verify a download

From PowerShell in the extracted folder:

Get-FileHash .\BluetoothRefresh.exe -Algorithm SHA256
Get-Content .\SHA256SUMS.txt

The values must match.

Reporting a vulnerability

Please email michaelshawnhurst@gmail.com with:

  • the affected version;
  • Windows version and architecture;
  • clear reproduction steps;
  • expected and observed behavior; and
  • any proof of concept that does not contain private data.

Please do not publish credentials, private device identifiers, or other people's data in an issue.

There aren't any published security advisories