Skip to content
Cyclop Technologies
DownloadGet a quote

Security

Reporting a vulnerability

Found a security problem in Cyclop OS, Cyclop Connect or this website? Thank you. Here is how to tell us, and what happens next.

How to report

Write to support@cyclop-tech.com with a subject that starts with "[security]". A person reads every message. Please include:

  • what is affected (package and version, app, or address);
  • how to reproduce it, step by step;
  • what an attacker could do with it, as far as you can tell.

How Cyclop OS protects you

  • Packages are signed. Our repositories are signed with the Cyclop OS key, and your machine refuses a package that does not match it.
  • A firewall is on from the installation, with incoming connections denied by default (Community from update 4.0.2).
  • Security updates from Ubuntu are applied automatically (Community from update 4.0.2).
  • Kernel hardening settings, a private DNS resolver and a tracker blocklist are included (Community from update 4.0.2).
  • USBGuard, which blocks unknown USB devices, is available on the paid editions. It is installed switched off, and one command turns it on.
  • We do not claim any certification: this list is what the system really does, nothing more.

What we commit to

  • We acknowledge your report within 2 working days.
  • We keep you informed while we investigate and fix it.
  • We credit you in the fix notes if you want to be named. We have no bug bounty, and we would rather say so plainly.
  • We take no legal action against good-faith research that follows the rules below.

What we ask of you

  • Do not access, change or keep data beyond what is needed to prove the problem.
  • No denial of service, no spam, no social engineering of our team or our users.
  • Give us reasonable time to fix it before you publish anything: 90 days by default, and we will tell you if we need less or more.

Scope

Covered by this policy:

  • Cyclop OS packages served from packages.cyclop-tech.com;
  • cyclop-tech.com and its subdomains;
  • the Cyclop Connect apps (desktop and mobile).

Out of scope

Bugs in unmodified Ubuntu or Debian packages belong upstream: please report them to Ubuntu or Debian directly. We follow Ubuntu security notices and ship their fixes to Cyclop OS.

How long we support Cyclop OS

Cyclop OS 4.x receives security updates until the end of Ubuntu 24.04 standard support (April 2029).

See also