Maran installs a daemon that runs as root and a panel that provisions system users. A defect here is not an inconvenience, so a report about one is welcome and will be answered.

Write to security@innovayse.com. Do not open a public issue, and do not describe the problem in a pull request before it is fixed.

We acknowledge within 48 hours. Critical issues target a fix or a documented mitigation within 14 days; less severe ones are scheduled and you are told when. Coordinated disclosure is honoured, and you are credited by the name you choose unless you ask not to be.

If you would rather encrypt, say so in a first message with no details and we will send a key.

Enough for us to reproduce it, and nothing that is not yours to send:

• what an attacker gains — read another tenant's files, escalate to root, bypass a limit
• the smallest sequence that shows it, and which distribution and version you saw it on
• whether it needs an authenticated session, and at which role
• logs if they help, with tokens, hostnames and customer data removed

Until 1.0, only the latest release receives fixes. After 1.0 this section will name the versions that do.

In scope — anything in this repository: the panel API, the SPA, the Rust agent and its socket, the installer, and the templates the agent renders. Reports about the design are in scope too: if a rule we wrote down is the wrong rule, that is worth more than a bug.

Out of scope — findings that require an attacker to already be root on the host, denial of service by exhausting the machine's own resources, missing hardening headers with no demonstrated impact, and reports produced only by a scanner with no reasoning attached.

Test against your own installation. Probing somebody else's server running this software is not research, and no finding excuses it — we will not accept a report obtained that way, and it may be a crime where you or they are.

A local install is one command; CONTRIBUTING.md describes a development stack that runs without touching a real host at all.

• Changes to authentication, sessions and tokens, the agent's privilege dropping, licence verification, or the installer's privileged steps require a second reviewer and a written threat note in the pull request. rules/security.md is the checklist that review uses.
• Dependency versions are pinned and updated deliberately: backend/Directory.Packages.props for .NET, agent/Cargo.lock for Rust, frontend/package-lock.json for npm. There is no automatic update bot — an update to a panel that runs as root is a change somebody reads. THIRD-PARTY-NOTICES.md lists every distributed dependency and its licence.
• Secrets never enter the repository. /etc/maran/panel.env is root:maran 0640 on a server, and the development values in .env.example are throwaways that must never reach one.