Security Policy

Supported Versions

We release patches for security vulnerabilities. Which versions are currently
supported:

Reporting a Vulnerability

We take the security of Linuxy seriously. If you believe you have found a
security vulnerability, please report it to us as described below.

How to Report

Please do NOT report security vulnerabilities through public GitHub issues.

Instead, please report them via email at: [email protected] (or
use GitHub's private vulnerability reporting feature)

You should receive a response within 48 hours. If for some reason you do not,
please follow up via email to ensure we received your original message.

What to Include

Please include the following information in your report:

• Type of issue: e.g., buffer overflow, SQL injection, cross-site scripting,
  etc.
• Full paths of source file(s) related to the issue
• Location of the affected source code (tag/branch/commit or direct URL)
• Step-by-step instructions to reproduce the issue
• Proof-of-concept or exploit code (if possible)
• Impact of the issue, including how an attacker might exploit it

Preferred Languages

We prefer all communications to be in English.

Security Best Practices

For Users

1. Download from official sources only

   • GitHub Releases: https://github.com/swadhinbiswas/linuxy/releases
   • Official package repositories (AUR, etc.)

2. Verify checksums

   • All releases include SHA256 checksums
   • Verify before installing

3. Keep Linuxy updated

   • Enable automatic updates when available
   • Check for updates regularly

4. Use Firejail sandboxing

   • Enable sandboxing for untrusted AppImages
   • Keep Firejail updated

For Contributors

1. Never commit sensitive data

   • API keys
   • Passwords
   • Tokens
   • Personal information

2. Follow secure coding practices

   • Validate all inputs
   • Use parameterized queries
   • Implement proper error handling
   • Avoid hardcoded credentials

3. Keep dependencies updated

   • Regularly run npm audit
   • Regularly run cargo audit
   • Update vulnerable packages promptly

Security Measures

Automated Scanning

• Dependency scanning: Automated via GitHub Actions
• Code scanning: CodeQL analysis on all PRs
• Secret scanning: GitHub secret scanning enabled

Build Security

• Reproducible builds: Working towards reproducible builds
• Signed releases: Release artifacts are signed
• Minimal permissions: CI/CD runs with minimal required permissions

Code Review

• Required reviews: All PRs require at least one review
• Security-focused review: Security-sensitive changes get extra scrutiny
• AI-assisted review: CodeRabbit AI reviews all PRs

Security Updates

Security updates will be released as patch versions (e.g., 0.1.1, 0.1.2).

For critical vulnerabilities, we may release an out-of-cycle security update.

Disclosure Policy

1. Reporter submits vulnerability report
2. We acknowledge receipt within 48 hours
3. We investigate and confirm the vulnerability
4. We develop and test a fix
5. Fix is deployed to supported versions
6. Public disclosure after 30 days (or earlier by mutual agreement)

Recognition

We believe in recognizing security researchers who help improve our security.
Researchers who report valid security vulnerabilities will be:

• Acknowledged in our security advisories (unless they wish to remain anonymous)
• Added to our security hall of fame
• Sent swag stickers (when available)

Contact

• Email: [email protected]
• GitHub: Use private vulnerability reporting
• PGP Key: Available upon request

Security Checklist for Releases

Before each release, ensure:

• All dependencies are up to date
• No known vulnerabilities in dependencies
• Code has been reviewed for security issues
• No sensitive data in code or config files
• Build process is secure
• Release notes mention any security fixes

Last Updated: March 2024