# Security Policy
<!--
SPDX-FileCopyrightText: 2026 Manuel Gil
SPDX-License-Identifier: GPL-3.0-or-later
-->
Security is a fundamental engineering principle of Amonite.
The project improves security through deliberate engineering decisions, careful system integration, and sensible defaults built upon the Debian platform, rather than by relying primarily on additional security software.
> **Every default is an intentional decision.**
## Supported releases
Security fixes are provided only for releases the project supports.
| Release family | Published editions | Support posture |
| -------------- | -------------------------------------------- | --------------------------- |
| Nautilus (1.x) | Standard `1.0.0-alpha.2`, Lite `1.0.0-alpha` | Evaluation and testing only |
Pre-release versions may contain known issues and are not suitable for production environments. Mobile is experimental and has no public release.
## Default security posture
Published Alpha editions include:
- mandatory access control enabled by default;
- optional encrypted installation through the graphical installer;
- cryptographically signed release artifacts for independent verification.
Release verification: [VERIFY.md](VERIFY.md).
Signing key: [security/amonite-signing-key.asc](security/amonite-signing-key.asc)
Fingerprint:
```text
0AFF 5507 8845 4862 6087 F84A 5E1E 335B 601F B44B
```
## Reporting a vulnerability
If you believe you have found a security vulnerability in Amonite, report it responsibly.
Preferred contact:
```text
security@amonite.org
```
The official communication channels listed at [amonite.org](https://amonite.org/) also work.
Please include:
- a clear description of the issue;
- affected edition(s) and release(s);
- steps to reproduce the problem;
- expected and observed behaviour;
- any relevant logs or technical information.
Do not report vulnerabilities through public issue trackers or the public subreddit while a private channel is available, and please avoid public disclosure until the report has been evaluated.
## Security principles
**Platform first.** Whenever practical, Amonite builds upon Debian's mature security mechanisms before introducing project-specific solutions.
**Least complexity.** Reducing unnecessary software, services, and custom infrastructure improves auditability and lowers long-term maintenance.
**Transparency.** Security mechanisms should remain understandable. Users should be able to inspect, configure, and reason about the behaviour of their systems.
**Continuous evaluation.** Security decisions are reviewed as Debian and related upstream software evolve. Better approaches may replace existing implementations whenever they offer measurable improvements and remain consistent with the project's engineering principles.
## Scope
Amonite is responsible for the engineering decisions the project introduces.
Security issues originating in upstream software, Debian packages, or third-party components are addressed through their respective maintainers, though the project may publish updated releases when appropriate.
## Disclosure
The project follows a coordinated disclosure process whenever practical. Reported vulnerabilities are evaluated, reproduced where possible, and addressed according to their impact on supported releases. Security-related changes are documented in the corresponding release notes.
## Related documentation
- [VERIFY.md](VERIFY.md) - Verifying official releases
- [security/README.md](security/README.md) - Release signing key directory
- [CAPABILITIES.md](CAPABILITIES.md) - Security capability overview