Reporting a vulnerability
Report privately through GitHub Security Advisories, or by email to security@lunos.tech. The process, from intake to disclosure, is in SECURITY.md.
Trust
Trust and security documentation
For procurement and security reviewers: what Lunos does, what it doesn't, and where each statement is backed. Lunos holds no certification and claims none.
Documents
The Trust pack
| Document | Covers | Status |
|---|---|---|
| Security overview | Architecture, trust boundaries, and a threat model: prompt injection, tool execution, supply chain, secrets, the audit log | Published. Each threat says what is mitigated and what is not |
| Supply chain | How releases are built, how to verify them, the SBOM, and marketplace review | Published. npm provenance, and Sigstore-signed checksums from v1.18.40; no OS code signing |
| EU Cyber Resilience Act | Scope assessment and readiness: SBOM, vulnerability handling, support periods | Published. Likely outside CRA scope; 6 months of security fixes per release, from v1.18.43 |
| Data protection (GDPR) | Controller and processor roles, data sent to model providers, a DPIA checklist | Published. Counsel review of this note is pending |
| Accessibility | EN 301 549 / WCAG 2.1 AA statement and conformance report | Not yet published. Audit in progress |
| CSA CAIQ v3.0.1 answers | Pre-filled answers to all 295 questions, with a spreadsheet copy | Published. Organisational questions are marked for ITService EOOD to answer |
Statements apply to the latest release, v1.18.48, unless marked "from the next release". The pack is versioned with the source; the authoritative copy is docs/trust in the repository.
Support
How long a release gets security fixes
Each release gets security fixes for 6 months from its release date, starting with v1.18.43; earlier releases have no support period. A fix ships as a new release, and its GitHub Security Advisory names the affected versions and the release that fixes them. A release's date is on the changelog: support ends 6 months after it. When a newer release exists, Lunos says so at startup, and lunos update moves to it.
Sign-offs
Who reviewed what
| What | Who | Date |
|---|---|---|
| Data protection (GDPR) note | Counsel review pending (XCOD-226) | not yet |
| security@lunos.tech receives mail (test message sent and received) | ITService EOOD | 2026-09-29 |
| Independent re-check of the five-statement spot-check of the Trust pack | Ivan P | 2026-10-01 |
| 6-month security support period | ITService EOOD | 2026-10-02 |
Where your data goes
Lunos is self-hosted: ITService EOOD runs no service in the data path unless you sign in to a Lunos account, and there is no telemetry. If you sign in, sessions sync to Lunos Cloud (cloud.lunos.tech, EU) until you turn sync off; see session sync. The full account is in the self-hosted deployment guide.