$ cat /.well-known/security.txt
Reporting a security problem
elsieOS runs on machines people trust with their models and their data. If you find a way to break that trust, we want to hear about it first.
How to report
Email security@elsieos.com with what you found, the version (or the page, for this website) and the steps to reproduce it. Please do not post it publicly until it is fixed.
What you can expect
- A reply confirming we received it.
- Updates while we work on a fix, and a date when it will be published.
- Credit in the release notes, if you want it.
In scope
- elsieOS itself: the system image, updates and rollback, the model server, the GPU manager, the
elsiecommands. - This website, elsieos.com.
Please test only against your own machines, never against other people's systems or data.
how elsieOS is protected
- Secure Boot with a signed kernel and signed NVIDIA modules
- Kernel lockdown on
- Read-only system files, checked by a hash tree
- Updates in a spare slot, rolled back after 3 failed starts
- SSH with keys only
- Model server limited to local, home and Tailscale networks by default
- No telemetry, nothing that phones home
- Hardware watchdog
Contact: mailto:security@elsieos.com Expires: 2027-11-01T00:00:00.000Z Preferred-Languages: en Canonical: https://elsieos.com/.well-known/security.txt Policy: https://elsieos.com/security/