Security Policy
Last updated October 2026
Short version
Report vulnerabilities privately, not as a public GitHub issue. Credentials are encrypted on your machine, and the app has no telemetry by default. The paragraphs below cover reporting, response times, and what's actually protected. For the full technical breakdown, see the security documentation linked at the bottom of this page.
Reporting a vulnerability
Do not open a public GitHub issue for a security vulnerability. Report it privately by email at support@aerini.org, or through GitHub's private vulnerability reporting if you have access to the repository. Include a description of the issue, steps to reproduce it, the affected version, and your assessment of its impact.
Response timeline
- 48 hours: acknowledgment that your report was received.
- 7 days: initial assessment and severity classification.
- 30 days: a fix or mitigation for confirmed vulnerabilities.
- 90 days: public disclosure, coordinated with whoever reported it.
Reports made in good faith won't result in legal action, and we follow responsible disclosure for anything confirmed.
Supported versions
Security patches go to the latest release and the previous minor version, for 90 days after the newer one ships. Older versions don't receive patches, so staying reasonably current matters.
Scope
In scope: the Aerini engine, the server binary, the desktop app, and the official Docker image. Out of scope: third-party services a workflow node happens to connect to, such as Slack or Stripe. A vulnerability in one of those services is a report for that vendor, not for Aerini.
What Aerini protects by default
Credentials are encrypted with AES-256-GCM, with the encryption key held in your OS keychain rather than alongside the encrypted data itself. Aerini makes no telemetry calls, no analytics calls, and no automatic update pings. Nodes that can run arbitrary code on your machine, like Shell Command and Code (JS), trigger a warning before a workflow containing them runs. The HTTP node blocks requests to internal and private IP addresses to reduce the risk of server-side request forgery, though this protection has a known gap around DNS timing that only an egress firewall closes completely. For the full model, including server-deployment hardening and how each protection actually works, see the security documentation.
This website
The site is static: no accounts, no forms, no database. Every script, stylesheet, and font is served from this domain, except the Pricing page's checkout script, which is pinned to an exact version and verified with a Subresource Integrity hash. A Content Security Policy blocks inline scripts and styles and limits where the page can load content or send requests. Our contact details are also published as a security.txt file.
Contact
Security reports and questions about this page: support@aerini.org.