We release patches for security vulnerabilities. Which versions are currently supported:

We take the security of Linuxy seriously. If you believe you have found a security vulnerability, please report it to us as described below.

Please do NOT report security vulnerabilities through public GitHub issues.

Instead, please report them via email at: swadhinbiswas.cse@gmail.com (or use GitHub's private vulnerability reporting feature)

You should receive a response within 48 hours. If for some reason you do not, please follow up via email to ensure we received your original message.

Please include the following information in your report:

• Type of issue: e.g., buffer overflow, SQL injection, cross-site scripting, etc.
• Full paths of source file(s) related to the issue
• Location of the affected source code (tag/branch/commit or direct URL)
• Step-by-step instructions to reproduce the issue
• Proof-of-concept or exploit code (if possible)
• Impact of the issue, including how an attacker might exploit it

We prefer all communications to be in English.

1. Download from official sources only

   • GitHub Releases: https://github.com/swadhinbiswas/linuxy/releases
   • Official package repositories (AUR, etc.)

2. Verify checksums

   • All releases include SHA256 checksums
   • Verify before installing

3. Keep Linuxy updated

   • Enable automatic updates when available
   • Check for updates regularly

4. Use Firejail sandboxing

   • Enable sandboxing for untrusted AppImages
   • Keep Firejail updated

1. Never commit sensitive data

   • API keys
   • Passwords
   • Tokens
   • Personal information

2. Follow secure coding practices

   • Validate all inputs
   • Use parameterized queries
   • Implement proper error handling
   • Avoid hardcoded credentials

3. Keep dependencies updated

   • Regularly run npm audit
   • Regularly run cargo audit
   • Update vulnerable packages promptly

• Dependency scanning: Automated via GitHub Actions
• Code scanning: CodeQL analysis on all PRs
• Secret scanning: GitHub secret scanning enabled

• Reproducible builds: Working towards reproducible builds
• Signed releases: Release artifacts are signed
• Minimal permissions: CI/CD runs with minimal required permissions

• Required reviews: All PRs require at least one review
• Security-focused review: Security-sensitive changes get extra scrutiny
• AI-assisted review: CodeRabbit AI reviews all PRs

Security updates will be released as patch versions (e.g., 0.1.1, 0.1.2).

For critical vulnerabilities, we may release an out-of-cycle security update.

1. Reporter submits vulnerability report
2. We acknowledge receipt within 48 hours
3. We investigate and confirm the vulnerability
4. We develop and test a fix
5. Fix is deployed to supported versions
6. Public disclosure after 30 days (or earlier by mutual agreement)

We believe in recognizing security researchers who help improve our security. Researchers who report valid security vulnerabilities will be:

• Acknowledged in our security advisories (unless they wish to remain anonymous)
• Added to our security hall of fame
• Sent swag stickers (when available)

• Email: swadhinbiswas.cse@gmail.com
• GitHub: Use private vulnerability reporting
• PGP Key: Available upon request

Before each release, ensure:

• All dependencies are up to date
• No known vulnerabilities in dependencies
• Code has been reviewed for security issues
• No sensitive data in code or config files
• Build process is secure
• Release notes mention any security fixes

Last Updated: March 2024