Raykosan-ComfyUI_RaykoStudio/SECURITY.md

Security Policy

This document describes the security posture, network activity, and file handling of the ComfyUI-RaykoStudio custom node pack. We aim for transparency so that users and automated scanners can verify that there is no malicious behavior.

What the Pack Does

ComfyUI-RaykoStudio provides custom nodes for ComfyUI, including:

• A LoRA loader that fetches metadata from Civitai using a SHA256 hash.
• Image saving with restricted output paths.
• Color adjustment and other utility nodes.
• WebSocket communication with the ComfyUI frontend for UI updates.

The pack does not collect telemetry, send user data to third-party servers (except for explicit Civitai API requests for LoRA metadata), or execute externally supplied code.

Network Operations

Civitai API Requests

In Rayko_LoRA_Loader.py and rayko_api.py, aiohttp is used to perform a GET request to:

https://civitai.com/api/v1/model-versions/by-hash/{sha256}

• Purpose: Retrieve model information (name, description, trained words) based on the LoRA file hash.
• Data sent: Only the SHA256 hash of the LoRA file. No user data, paths, or file contents are transmitted.
• Direction: Outbound only. The response is used to populate a local metadata database.
• User-Agent: ComfyUI-RaykoStudio/1.0 — for client identification.

If you do not want the pack to contact Civitai, avoid using the metadata-related nodes or block civitai.com at the network level.

WebSocket in the Frontend

In web/rs_adjustments.js and other JS files, this._ws.send(...) is used to send messages from the UI to the ComfyUI server. This is the standard mechanism for custom nodes to communicate with the backend, not a hidden data exfiltration channel.

File Operations

• Reading: The pack reads LoRA files and associated metadata from directories configured in ComfyUI.
• Writing:
  • Maintains a local JSON database of LoRA metadata.
  • Saves images via the Rayko_VAE_Save_Image node to allowed directories.
• Path restriction: Rayko_VAE_Save_Image.py implements an allowlist of root directories. The primary path is ComfyUI's output_dir. Additional roots can be set via the RS_EXTRA_OUTPUT_ROOTS environment variable.

Environment Variables

RS_EXTRA_OUTPUT_ROOTS

• Purpose: Allows an administrator to specify additional allowed directories for image saving.
• Format: A list of paths separated by os.pathsep (: on Linux/macOS, ; on Windows).
• Security: The variable is only read to extend the path allowlist. If not set, only the standard ComfyUI output paths are used.

JavaScript Code

The frontend uses standard patterns:

• .bind(this) — context binding in classes and event handlers.
• ws.send(...) — sending messages over WebSocket.

These constructs are not a threat and are common in any ComfyUI frontend code.

Dynamic Imports

Prior to version 0.48.3, the code contained a dynamic import:

__import__('datetime').datetime.now().isoformat()

In version 0.48.3, it was replaced with the standard:

from datetime import datetime
...
datetime.now().isoformat()

This eliminates the false positive $import_func_direct from security scanners. There are no other dynamic imports in the pack.

Absence of Dangerous Functions

The pack does not contain:

• eval(), exec()
• subprocess, os.system, os.popen
• Code obfuscation
• Hidden telemetry or data sent to unknown servers
• Automatic download and execution of third-party code

Compatibility and Supported Versions

Current version: 0.48.3 and later.
Always use the latest version to benefit from security fixes and improvements.

Reporting a Vulnerability

If you discover a potential security issue, please open an issue on GitHub or contact the author directly. We aim to respond within 48 hours.

When reporting, please include:

• Pack version
• File and line number
• Description of the issue and potential impact
• Steps to reproduce (if applicable)

Recommendations for Users

• Run ComfyUI in an isolated environment (container, venv).
• Restrict filesystem access where possible.
• Review custom node code before installation.
• Do not set RS_EXTRA_OUTPUT_ROOTS to directories containing sensitive data.
• Keep the pack updated.

Why a Scanner May Report Flagged

Automated security scanners (e.g., in ComfyUI-Manager) may flag the pack due to:

• Use of aiohttp.ClientSession (network operations).
• Presence of ws.send(...) in JS.
• Use of .bind(...) in JS.
• Reading the os.environ.get(...) environment variable.

All of these are legitimate for this pack and are explained above. If a scanner still flags it, you may reference this document for clarification.

---

Last updated: 2026-09-27