Security Policy

Security is a central part of Winnux. If you find a security risk, report it responsibly.

Report a vulnerability

Do not publish security-critical vulnerabilities in a public issue. Follow the process in SECURITY.md in the repository instead.

Security principles

• Local accounts by default — no mandatory online accounts
• Telemetry disabled by default
• No advertising or marketing profiles in the operating system
• Personal files are not uploaded without explicit choice
• Signed supply chain planned for stable release
• SBOM/provenance planned for stable release

AI and security

AI agents may not handle signing keys, publish stable images, or modify protected production branches. AI-generated code is reviewed by humans before being added to trusted code.

Incident process

An incident process will be defined before stable release. It will cover:

• Reporting channels
• Response times
• Patch process
• User notification