We take security seriously. If you discover a security vulnerability in ResonantOS, please help us by reporting it responsibly.

Security vulnerabilities should never be reported through public GitHub issues.

Please report security issues through one of these private channels:

1. Email: manolorem@gmail.com
2. Discord: Direct message @ManoloRemiddi
3. GitHub: Use GitHub's private vulnerability reporting feature

Please provide:

• Description — Clear explanation of the vulnerability
• Impact — What could an attacker do?
• Reproduction Steps — How to reproduce the issue
• Affected Versions — Which versions are vulnerable
• Suggested Fix — If you have ideas (optional)

• 48 hours — Initial response acknowledging receipt
• 7 days — Assessment and severity classification
• 30 days — Target for fix and disclosure (may vary by severity)

ResonantOS is designed with security in mind:

• No Cloud Dependencies — Everything runs on your machine
• No Telemetry — We don't track usage or phone home
• Your Data Stays Yours — No external data collection

We implement multiple security layers:

1. Shield — 14 blocking security layers, file protection, YARA scanning (active)
2. Logician — Policy engine with 285+ facts, Mangle/Datalog rules (active)
3. Guardian — Self-healing and incident recovery (design phase)
4. File Locking — OS-level immutable flags for critical files

• All dependencies are reviewed
• No arbitrary code execution from external sources
• Sanitization before any public releases
• Regular security audits

• File Locking: Critical documents protected via OS-level immutable flags (chflags uchg on macOS/BSD)
• Sanitization Auditor: tools/sanitize-audit.py scans for leaked secrets before public releases
• Local Execution: All code runs locally, no external API calls without user consent

• Guardian: Anomaly detection, self-healing, incident recovery

ResonantOS is in alpha. Current limitations:

• Guardian is not yet complete
• Limited sandboxing for AI operations
• File locking requires manual setup
• No formal security audit yet

Use in production at your own risk. This is experimental software.

Security fixes are our highest priority:

• Critical: Patched immediately, released within 24-48h
• High: Patched within 7 days
• Medium: Patched in next regular release
• Low: Documented, fixed when feasible

• Watch this repository for security advisories
• Join our Discord for announcements: https://discord.gg/MRESQnf4R4
• Check releases for security patches

The Resonant Chamber DAO uses Solana blockchain:

• Soulbound Tokens ($RCT): Non-transferable, prevents trading attacks
• Multi-sig Treasury: Requires multiple approvals for fund movements
• Transparent Governance: All votes are on-chain and auditable
• Time Locks: Major changes require 7-day voting period

• OpenClaw Security
• Solana Security Best Practices
• OWASP Top 10

We appreciate responsible disclosure. Contributors who report valid security issues will be:

• Credited in release notes (if desired)
• Awarded $RCT governance tokens
• Recognized in the community

Security is a journey, not a destination. Help us build something secure together.

Thank you for helping keep ResonantOS safe.