Thank you for helping keep Termal OS and its users safe.

Termal OS holds the keys to your servers, so here is exactly how it treats them. The full, detailed version lives at termalos.com/security.

• Local-first. Your SSH credentials (passwords, private keys, passphrases) and your AI API key are encrypted at rest with AES-256-GCM, in a local database on your own machine. Nothing is stored on, or transmitted to, our servers.
• Encryption key. By default a random 256-bit key generated on first launch, stored with owner-only permissions and never transmitted. Optionally, a master password derives the key with scrypt and keeps it in memory only - never written to disk.
• Agentless. Nothing is installed on your servers - no agent, no daemon, no cron. Monitoring runs ordinary read-only SSH commands (ps, df, free...). No root required.
• Minimal network surface. Toward our infrastructure the app only signs you in, refreshes a signed license token (~daily), and reads a version manifest. No telemetry, no metrics, no hostnames, no commands ever leave your machine.
• AI copilot: your key, your provider. Off by default. When enabled, your prompt and a compact server snapshot go straight to the provider you chose (Anthropic or any OpenAI-compatible endpoint), on your own API key - we are never in the middle. Commands are proposed, never auto-run: nothing executes until you click.
• Updates. In-app alerts, no silent updates. Automatic binary updates are deliberately disabled on unsigned Windows/macOS builds; Linux ships via the sandboxed, store-reviewed Snap.
• Closed source, honestly. The app is proprietary; the Termal Studio SDK is MIT. You can verify the above yourself - watch the network traffic, and inspect your servers.

Full details, with the honest caveats: termalos.com/security.

Please do not open a public issue for security problems. Public disclosure before a fix puts users at risk.

Report privately, one of two ways:

1. GitHub private reporting (preferred): open the Security tab of any TermalOS repository and click "Report a vulnerability". This starts a private advisory visible only to you and the maintainer.
2. Email: write to hello@termalos.com with [Security] in the subject.

Please include:

• what the issue is and its impact,
• clear steps to reproduce (or a proof of concept),
• the Termal OS version and your operating system,
• any relevant logs, with secrets removed.

Termal OS is a solo project, so responses are best effort, but security is a priority:

• acknowledgement within 72 hours,
• an assessment and a plan within 7 days,
• a fix shipped as fast as reasonably possible, with credit to you if you want it (staying anonymous is fine too).

Please allow reasonable time to fix an issue before any public disclosure. We will not pursue legal action over good faith security research that respects this policy and does not harm users or their data.

In scope: the Termal OS desktop application, its update mechanism, the license API, and the termalos.com website.

Out of scope: issues that require an already compromised machine, social engineering, and automated scanner output without a demonstrated impact.

During the Preview, only the latest published release is supported. Please update before reporting.