Tempest is a cybersecurity project — we take vulnerability reports seriously.
Do not report security vulnerabilities via public GitHub Issues.
Instead, email: security@n0xnull.dev with the following details:
- Description of the vulnerability and its potential impact
- Steps to reproduce
- Affected component (
src/agent,src/web, database schema, etc.) - Version or commit hash
We will acknowledge receipt within 72 hours and coordinate on a fix and disclosure timeline.
| Component | Examples of issues in scope |
|---|---|
Agent (src/agent/) |
Authentication bypass, unencrypted payload leakage, arbitrary code execution via command injection |
Console (src/web/) |
Missing authorization on API routes, IDOR, SQL injection, XSS in the console UI |
| Database schema | Privilege escalation via schema misconfiguration |
| Transport | Weak encryption, key exposure, replay attacks |
- Issues that require physical access to the monitored endpoint.
- Denial-of-service against self-hosted instances.
- Intentional design trade-offs documented in README.md (e.g., console has no built-in auth — this is documented behavior with a recommended mitigation).
v4.0 uses AES-256 payload encryption and per-build binary mutation. Console authentication, TLS termination, and certificate pinning are on the roadmap for v4.1/v5.0 — see CHANGELOG.md and the roadmap section in README.md. Reports related to these known gaps are appreciated but may be deferred to the corresponding milestone.