We take security seriously. If you discover a vulnerability in LearnOS, please report it responsibly.

1. Open a private security advisory on GitHub (Security → Advisories → Report a vulnerability), or email the maintainers.
2. Do NOT open a public issue for security vulnerabilities.
3. Include as much detail as possible:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

• Acknowledgment within 48 hours
• Assessment within 7 days
• Fix or mitigation as soon as possible, depending on severity
• Credit in the release notes (unless you prefer anonymity)

LearnOS ships with hardening built in:

• LearnOS is single-user and self-hosted — there is no login, registration, or password storage by design. It's meant to run on your own machine or a private instance you control, so exposure of an authentication surface is avoided entirely.
• If you expose an instance to a network, put it behind your own access control (reverse-proxy auth, VPN, or firewall).

• Your OpenRouter API key is stored server-side only (encrypted at rest via ai/crypto.js) and never exposed to the frontend.
• All AI calls are proxied through the backend LLM layer (ai/llm.js), which meters usage (tokens + cost) for observability.

• Helmet sets secure HTTP headers.
• CORS is restricted to APP_URL in production (open only in dev).
• Rate limiting (express-rate-limit) protects against abuse.
• Use HTTPS in production (terminate at a reverse proxy).

• SSRF guard (middleware/url-safety.js) validates outbound fetch targets and blocks private/link-local addresses.
• File uploads are validated by magic bytes (not just extension) and constrained by type/size.
• User-supplied profile fields (avatar URL, bio, links) are validated and length-limited server-side.

• SQLite is used for storage; database files (db/*.db*) are gitignored.
• Secrets live in .env (gitignored). Use .env.example as a template and rotate keys regularly.
• No third-party telemetry is collected — learning data belongs to the learner.

• Run npm audit regularly and keep dependencies up to date.

This policy covers the LearnOS repository at github.com/Abelo9996/LearnOS. Third-party services (e.g. OpenRouter) are governed by their own security policies.