Trust and security

Report a security issue

If you find a vulnerability in linkos.io, openlinkos.com, linkos.org, the mirror domains, the status page or one of our open-source projects, write to security@linkos.io. Include what is affected, how to reproduce the issue and what an attacker could do with it.

While you look into it, please do not access other people's data, degrade the services for others, or publish the details before we have fixed the issue. We reply as soon as we can and tell you when the fix is out. We do not run a bug bounty.

Every one of our websites publishes these contact details in machine-readable form at /.well-known/security.txt. A project that has a SECURITY.md in its repository describes its own process there.

Signed releases

Our npm packages, such as Origin and the design system, are published from GitHub Actions with signed provenance, so you can check which commit and workflow built each release.

Privacy

Our websites use no analytics and no third-party trackers. The privacy notice covers the websites; the services listed on linkos.org have their own notice.

Abuse

To report abuse of a service or infringing content served through one, see Report abuse. To stop abuse or act on a valid complaint, we may limit or block addresses, clients or images.

Status and changes

LinkOS Status shows the live status and history of every service. Incidents are tracked in the uptime repository. When we can, we announce changes to a service ahead of time on the status page or on GitHub.