A drone is only as secure as the software that commands it. Ground station apps handle commands, keys, telemetry and often Remote ID data, so treat them as security critical software. This checklist covers signed links, key handling, logs, untrusted inputs and dependency hygiene, drawing on the MAVLink documentation and Remote ID reference.
Links and keys
- Enable message signing on every link that carries commands. MAVLink 2 signing adds a 48-bit signature and a timestamp, and receivers can reject messages without a valid one.
- Use a unique key per vehicle. The documented signing key is a 32-byte shared secret, so one leaked key signs for everyone who shares it.
- Load keys over a secure link only. The documentation says the key must never be broadcast or forwarded.
- Keep keys out of logs and parameters. The documentation says signatures and keys should be removed from telemetry logs.
- Limit unsigned message types. The documentation allows implementation specific rules for unsigned packets, such as accepting them over a secure wired link. Write down yours and why.
- Make insecure states obvious. If the app is set to accept badly signed packets, the documentation says it should carry a highly visible unsafe or insecure indication.
- Handle clocks carefully. Signature timestamps are only loosely tied to real time, and can drift on devices without a reliable time source.
Untrusted inputs
- Treat received Remote ID broadcasts as input, not truth. The open standard carries identifiers, location, altitude, direction and speed. Validate ranges and formats before showing or storing them.
- Treat telemetry the same way. A malformed message that parses should not crash the app or change vehicle state.
- Validate mission files and imported plans. A flight plan is code in all but name.
Storage and privacy
- Decide what you store. Flight logs and nearby Remote ID data reveal places and habits.
- Encrypt data at rest on the device, and set a retention period.
- Protect exports. A shared log can carry more than the user intended.
Updates and dependencies
- Sign your releases and verify them on install.
- Inventory dependencies for each release, including mapping libraries and protocol libraries. The documentation notes that the common C and Python MAVLink libraries support one key per link, so know the limits of what you import.
- Scan for advisories on every build, and decide who owns the response.
- Keep the update path fast. A fix that takes months to reach users is a long exposure.
Operations
- Separate roles if a team shares a fleet, so one operator's credentials cannot command every vehicle.
- Log commands and who sent them, without keys.
- Plan for link loss and bad data, with a defined safe behavior.
Where tooling helps
Safeguard's SBOM generation and dependency scanning cover items 15 and 16 for software you build, and a free scan is available at https://gold.safeguard.sh/scan. Radio security and flight behavior need their own testing.
Quick check
Does message signing hide the contents of a command?
No. It lets a receiver verify the sender holds the key. It does not encrypt.
Sources
Last reviewed: 19 October 2026.
