Skip to content

Security: chavooosss/AtlasOS

Security

SECURITY.md

Security policy

AtlasOS 0.6.4 is the current Development Preview source line; its ISO is not yet validated. The 0.6.3 candidate is historical. It is not presented as a production or universally supported system. Security review and supported-version policy remain limited for this development preview. One owner-reported UEFI Live test passed on a Casper Excalibur G870; this is not broad hardware validation.

Reporting a vulnerability

After the GitHub repository is created, the project owner should enable GitHub private vulnerability reporting if it is available. Use that private channel for vulnerabilities that could expose users, systems, or data. Do not publish credentials, private diagnostics, exploit details, or identifying device/network information in a public issue when disclosure could create risk.

No personal email address or external reporting channel is designated here. If private reporting is unavailable, avoid including sensitive exploit details in a public report and request a private contact route through the project owner.

Diagnostic data

AtlasOS diagnostic bundles can contain system, hardware, service, boot, or log information. Review a bundle for personal, device, network, and filesystem details before sharing it. Use only the intended removable target for diagnostic export and do not bypass the documented storage-safety checks.

Scope

Security fixes and response timing are handled case by case. No formal support window or guaranteed response time is currently established.

There aren't any published security advisories