SECURITY POLICY

Security Policy

How to report vulnerabilities and how EmbeddedOS is built to be secure.

Report a Vulnerability

Do not open a public GitHub issue for security vulnerabilities. Email security@embeddedos.org with details. We will respond within 48 hours.

Responsible Disclosure

Email security@embeddedos.org with vulnerability details. We follow a 90-day disclosure timeline. Critical vulnerabilities are patched within 7 days.

Scope

All EmbeddedOS repositories on GitHub are in scope: EoS kernel, eBootloader, EAI, ENI, EIPC, eBuild, EoSim, EoStudio, eDB, eBrowser, eOffice, and all related tooling.

Out of Scope

Third-party dependencies, GitHub infrastructure, social engineering attacks, and physical attacks on hardware are out of scope.

Recognition

Security researchers who responsibly disclose valid vulnerabilities are credited in the security advisory and our Hall of Fame.

Security Architecture

Capability-Based Security
EoS uses capability tokens for all inter-process communication. Processes cannot access resources they were not explicitly granted at creation time.
Verified Boot Chain
eBootloader implements a 5-stage verified boot with Ed25519 signatures, hardware root of trust, and rollback protection.
Memory Safety
EoS enforces strict memory isolation between processes using MPU/MMU. Stack canaries and ASLR are supported on capable hardware.
Cryptographic Primitives
The EoS crypto module provides AES-256-GCM, ChaCha20-Poly1305, Ed25519, X25519, SHA-3, and BLAKE3 — all with constant-time implementations.
Secure OTA Updates
All firmware updates are signed with Ed25519 and verified before activation. Version rollback is prevented by a hardware-backed counter.
Post-Quantum Roadmap
CRYSTALS-Kyber and CRYSTALS-Dilithium are on the v0.3 roadmap for quantum-resistant key exchange and signatures.

Contact Security Team

security@embeddedos.org