HOTS Hosts is an open-source Windows utility for managing the system hosts file, parental controls, application blocking, DNS configuration, and privacy-related Windows settings.
Because some features make system-level changes and require Administrator privileges, security issues are taken seriously.
The source code is publicly available in this repository.
If you believe you have found a security vulnerability in HOTS Hosts, please do not disclose sensitive details publicly before contacting the maintainer.
Please report security issues privately by email:
Where possible, include:
- HOTS Hosts version
- Windows version
- affected feature or component
- clear description of the issue
- steps to reproduce
- expected and actual behavior
- screenshots, logs, or proof-of-concept information if relevant
Please do not include passwords, personal data, or other sensitive information that is not necessary to reproduce the issue.
Examples of security issues include:
- unintended privilege escalation
- arbitrary code execution
- bypasses of parental-control restrictions
- unauthorized modification of protected files or registry settings
- unsafe handling of Administrator privileges
- insecure file or configuration handling
- vulnerabilities that could allow another local application or user to abuse HOTS Hosts
General bugs, usability problems, false positives from diagnostic heuristics, and feature requests can be reported through GitHub Issues instead.
HOTS Hosts performs legitimate system-level operations because that is required for several of its features.
The application is not designed to defend a system against a user or attacker who already has unrestricted Administrator privileges.
In particular, parental-control features are intended primarily to reduce casual or inexperienced bypass attempts. They should not be considered an enterprise-grade security boundary.
Security fixes are primarily intended for the latest released version.
| Version | Security support |
|---|---|
| Latest release | Supported |
| Older releases | Best effort |
| Development versions | Not guaranteed |
Users are encouraged to update to the latest release.
Depending on which features are enabled, HOTS Hosts may modify:
- the Windows
hostsfile - DNS configuration
- Windows Firewall rules
- Windows Services
- Windows Scheduled Tasks
- Windows Registry policies
- file-system ACLs
- Image File Execution Options (IFEO)
- Windows System Restore configuration
These operations are intentional parts of the application.
Users should review the documentation and source code before enabling system-level features they do not need.
HOTS Hosts does not require an online account for normal operation.
The application is designed primarily to operate locally.
Features that can involve network communication include, depending on the action performed:
- the built-in update checker, which checks GitHub Releases for newer versions
- public DNS queries used by the domain-existence diagnostic
- DNS configuration changes when the user enables Cloudflare Family DNS
- any network activity initiated by Windows or third-party components affected by the user's configuration
This project does not claim that every network request generated by Windows itself can be attributed to HOTS Hosts.
Where a feature supports rollback, HOTS Hosts may save the previous state before applying a change.
Users should still maintain independent system backups and should consider creating a Windows System Restore point before making substantial configuration changes.
Please allow reasonable time for investigation and remediation before publicly disclosing a confirmed vulnerability.
Security reports help improve HOTS Hosts and are appreciated.