Back to Security Overview
Security Team
Vulnerability Disclosure Policy
We welcome security researchers and community auditors who identify vulnerabilities in our kernel configs, NetGuard firewall, sandboxes, or build pipeline.
Official Security Contact
Send all vulnerability discoveries and leak reports to:
security@snigdhaos.org
OpenPGP Release & Security Key Fingerprint:
2BDB 00AE 6CAB EF0E 4052 0A8F 553F D42B 02A8 211A
What Makes a High-Quality Report
- ›Clear Description: Detail the affected subsystem (NetGuard, Amnesia, Persistence, AppArmor, or Build).
- ›Reproduction Steps: Provide deterministic CLI commands, scripts, or network captures.
- ›Impact Assessment: Explain whether the issue enables cleartext leaks, privilege escalation, or persistence compromise.
- ›Sanitized Logs: When attaching logs, ensure bridge IPs, MAC addresses, and credentials are redacted.
What NOT to Report as a Vulnerability
To respect everyone’s time, please do not file reports regarding documented architectural boundaries:
- • Attacks requiring prior root or physical UEFI firmware implants on the host computer.
- • Cryogenic DRAM capacitor cold-boot physical key extraction.
- • Theoretical end-to-end global traffic correlation without novel protocol defects.
- • Social engineering or operational security mistakes by the live user.