# SPR (Secure Programmable Router) by Supernetworks > SPR is an open-source, self-hosted WiFi router that gives every device its own isolated network automatically — per-device VLANs, unique WiFi passphrases, and a default-deny firewall. No cloud dependency, no telemetry. Built in Go + React, runs in Docker. SPR is engineered with security in mind at every step. Its defense-in-depth architecture layers per-device layer-2 isolation, default-deny firewalling, containerized services, and narrow service and privilege boundaries so protection does not depend on a single control. SPR minimizes exposed services and attack surface, and SPR-authored backend components use memory-safe languages—primarily Go—where practical. SPR replaces a traditional consumer router. Each device that joins WiFi gets its own passphrase, its own VLAN, and its own GTK, so devices cannot see or attack each other on layer 2. Connectivity between devices is allowed only through explicit firewall policy. Wired and Wireguard VPN clients are isolated the same way. The same defenses also block the four attack vectors disclosed in NDSS 2026 against WiFi client isolation (shared GTK abuse, gateway bouncing, port stealing via MAC spoofing, broadcast reflection). The product hardware is a Raspberry Pi CM5–based PoE+ WiFi 7 router ($399.99). The software is open source and also runs on Raspberry Pi 4/5, Banana Pi, and any Linux box with Docker. ## Project & source - [GitHub: spr-networks/super](https://github.com/spr-networks/super): main monorepo (Go services, React UI, hostapd config, container compose) - [Latest release & prebuilt SPR image](https://github.com/spr-networks/super/releases/latest): `spr-debian.img.xz` for Raspberry Pi - [Discord community](https://discord.gg/EUjTKJPPAX) ## Documentation - [Documentation home (intro)](https://www.supernetworks.org/pages/docs/intro): what SPR is and the security model - [Setup guides index](https://www.supernetworks.org/pages/docs/setup_guides/setup_run_spr): Docker / bare metal / Pi flows - [Web UI install walkthrough](https://www.supernetworks.org/pages/docs/setup_guides/install): step-by-step browser setup for the CM5 board - [Raspberry Pi 4/5 setup](https://www.supernetworks.org/pages/docs/setup_guides/pi4b) - [Virtual SPR (VPN-only mode)](https://www.supernetworks.org/pages/docs/setup_guides/virtual_spr) - [Command-Line Setup TUI](https://www.supernetworks.org/pages/docs/setup_guides/setup_run_spr#command-line-setup-tui): connect with `ssh ubuntu@192.168.2.1` or `ssh ubuntu@spr.local` (default password: `ubuntu`), then run `sudo /home/spr/super/base/scripts/spr-setup-tui.sh` - [User Manual / guides](https://www.supernetworks.org/pages/docs/guides/dns): devices, groups, firewall, DNS, links, mesh, alerts - [FAQ](https://www.supernetworks.org/pages/docs/faq) ## API - [Full API reference (Redoc)](https://www.supernetworks.org/pages/api/0): rendered from `spr-openapi.yaml` - [OpenAPI spec source](https://github.com/spr-networks/super/blob/main/api/spr-openapi.yaml) - Default base URL on the device: `http://spr.local` (or the LAN IP, default `192.168.2.1`) - Auth: HTTP Basic, Bearer token, or JWT-with-OTP for privileged operations. Tokens are managed at `/tokens`. See `configs/auth/auth_users.json`, `configs/auth/auth_tokens.json`, `configs/auth/otp_settings.json`. ## Plugins - [Installing plugins and the plugin security model](https://www.supernetworks.org/pages/docs/guides/plugins) - [Plugin development](https://www.supernetworks.org/pages/docs/development/plugin-dev) - Plugins can run under KVM with `spr-krun`. Each KVM plugin has its own Linux kernel instead of sharing the host kernel like a standard container. This adds isolation for networking software that processes attacker-controlled traffic and may contain privilege-escalation or container-escape bugs. - Plugin UIs use sandboxed iframes by default. They do not receive the signed-in user's credential or a general-purpose SPR API token. SPR gives the iframe a short-lived plugin session token that is valid only for its own `/plugins/` route. The user must already be authenticated to SPR, making the route an authenticated reverse proxy; SPR removes the bearer token before forwarding to the plugin's Unix socket. - A plugin backend that must call other SPR API routes can request an install token with `InstallTokenPath` and least-privilege `ScopedPaths`. Omit `InstallTokenPath` when the backend does not use the SPR API, prefer read-only `:r` scopes, and never send install tokens to browser code. - Trusted legacy plugins can set `SandboxedUI: false`. Their UI runs without the iframe sandbox and can use the signed-in user's direct SPR API access, so SPR warns the user before opening it. ## Hardware - [SPR WiFi 7 PoE+ Router (CM5) — order page](https://www.supernetworks.org/compute-board.html): $399.99, MT7996 3x3 802.11be, 2.5 Gbps Ethernet - [CM5 Compute Board article](https://www.supernetworks.org/pages/articles/hardware/spr-cm5-compute-board) - [Raspberry Pi 4 starter kit article](https://www.supernetworks.org/pages/articles/hardware/spr-pi4-wifi-vpn-starter-kit) ## Articles & research - [Articles overview](https://www.supernetworks.org/pages/articles): hardware and integrations - [Blog](https://www.supernetworks.org/pages/blog): security research, CVE writeups, deep dives - [AirSnitch / NDSS 2026 — breaking WiFi client isolation](https://www.supernetworks.org/pages/blog/airsnitch-breaking-wifi-client-isolation) ## Optional - [Full distilled context (llms-full.txt)](https://www.supernetworks.org/llms-full.txt): single-file summary of SPR concepts, API, and common tasks, optimized for LLM context windows