Security

1. How to report

Write to contact@lnkstart.com with what you found, how to reproduce it, the version (lnkstart --version) and where you tested it. Privately, please: do not publish it until there is a release that fixes it (section 4).

2. What is covered

• The lnkstart program: the server, the agent and the protocol between them.
• The installer (install.sh), the downloads under /releases/ with their signatures, and lnkstart update.
• This site and its API: registration, accounts, the panel and licenses.

3. What is not

• Testing against other people's LnkStart servers: each belongs to its owner, not to us. Install your own and test there.
• Denial of service, spam, social engineering or physical access.
• Automated reports with no way to reproduce them.

4. What we do with your report

• We answer within 5 working days at most, saying whether we could reproduce it and what we are going to do.
• We fix it, publish a release with the fix and describe it in its changelog; with your name, if you want.
• We ask you to wait for that release, and 90 days at most from your report, before making it public.
• We do not pay bounties.

5. Good faith

If you research within these rules —seeing no one else's data beyond what it takes to show the flaw, taking no service down, and telling us before anyone else— we will not take legal action against you for it.

6. How to know a binary is ours

lnkstart update only installs a release whose manifest is signed, and checks it with the keys built into it; lnkstart verify-release does the same with a download. A binary that fails that check is not ours.