Security and privacy
ElastOS is built so that software gets only the access you grant, releases are checked before they install, and your data stays on your computer. This page says what is protected today and what is not yet.
What protects you today
- Signed releases. Every release is signed by the maintainer and every part is checked by hash. A changed or fake release is refused. Details
- Passkeys. No passwords to steal or reuse. Your private key never leaves your device.
- Permission checks. Every App action goes through the Runtime, which checks the App’s signed token, the person and the permission. Missing permission means the action fails and says why.
- Sandboxed Apps. Each App runs in its own sandboxed browser frame. Web pages in Browser open in a separate sandbox.
- Local first. Your files, keys and local AI stay on your computer. Hosted AI sends nothing until you approve it in Inbox.
- Contacts only. Your Home sends shared files only to accepted contacts, and takes files only from contacts.
- Terminal off. The web Terminal is off by default. Guests cannot see the security log or use the Terminal.
Known limits
⚠️
These are stated openly so you can decide what to keep in ElastOS today.
- Home can use every App’s permissions. If Home were compromised, so would be the Apps’ access. The goal is for Home to only pass permissions on.
- Providers and background services run with your computer account’s rights. Only the AI model provider is partly confined.
- Approvals do not yet have a screen that only ElastOS controls.
- Locking Home does not hide your data from your computer. Your computer account and root can read stored data and keys while Home is locked.
- A stolen device or Profile key needs a new identity.
- Importing a Recovery Kit does not yet ask for your passkey again.
- Community posts between networks pass through the main Community node, which can read them until relay support arrives.
- Hosted Homes: whoever runs a hosted Home can read its data, wallet keys and recovery material. Use hosted accounts only for public demos.
The isolation plan tracks the work to close these gaps. The security file in the source code lists open findings in technical detail.
Good habits
- Save your Recovery Kit with a password, and keep it private.
- Add a second passkey, such as a security key, in System > Accounts.
- Keep wallets with real funds small until the limits above are closed.
- Check the
Maintainer DID:line every time you run the install command. - Install updates when System offers them.
Report a vulnerability
If you find a security vulnerability, report it privately through GitHub Security Advisories.
Do not open a public issue, and do not describe an unfixed problem in a public issue, pull request, commit message or branch name.