Security

Kleinia runs privileged system services, its own kernel build and a gateway that holds your model credentials, so we take security reports seriously.

Report a vulnerability

Don’t open a public issue, discussion or chat thread. Instead:

• email security@kleinia.io, or
• use Report a vulnerability in the Security tab of the affected GitHub repository.

Please include the affected component and version (sudo bootc status), steps to reproduce, and the impact you expect. Reports can be written in English or Chinese.

	Target
Acknowledgement	Within 3 working days
Initial assessment	Within 10 working days
Fix for confirmed high or critical issues	As soon as practical, shipped as an image update

We will agree a disclosure date with you and credit you in the release notes, unless you prefer to stay anonymous.

Scope

In scope: Kleinia’s own code and the released images, for example agent identity and permission enforcement, the model gateway and its stored credentials, the context and memory service, the kernel changes, the installer and the update path.

Vulnerabilities in upstream projects that Kleinia ships unchanged (Fedora packages, Linux, GNOME, Flatpak apps) should be reported upstream. Tell us as well if Kleinia’s configuration makes them worse.

Getting security fixes

Only the latest image receives security fixes. Keep your system up to date:

sudo bootc upgrade
systemctl reboot

Update Flatpak apps with flatpak update.

Verifying what you install

Check every ISO against the signed checksums before installing. See Verify the download.

Keeping your keys safe

• Add model API keys to the model gateway only. Agents use the gateway and never see the keys.
• Don’t leave keys in shell profiles, project files or agent configuration.
• Review an agent’s execution trace if it did something you didn’t expect.