Security

Email security@anoneurx.com with a description, affected version, and reproduction steps. Please do not open a public issue for undisclosed vulnerabilities.

GitHub Security Advisories are accepted for the repository. No NDA is required and no legal action is taken against good-faith researchers.

• Acknowledgement within 48 hours
• Initial assessment within 5 business days
• Critical and high fixes within 14 days
• Medium fixes within 30 days
• Coordinated disclosure window of 90 days

Ten security commitments are published in SECURITY.md rather than asserted in marketing copy.

• Untrusted content is untrusted input
• The crawler cannot reach internal infrastructure
• No user profiling, no third-party requests, no sale of anything
• Explainable ranking — integrity is a security property
• Reproducible, scanned and signed artifacts
• Least privilege enforced by database role
• The admin console is never publicly reachable
• Incident response is documented and rehearsed
• Limits are disclosed honestly

35 threats (T01–T35) are enumerated using STRIDE plus privacy and abuse passes, covering six adversary classes, eight ranked assets and seven trust boundaries.

Every threat carries an impact, a likelihood, a mitigation and an explicit residual risk statement.

• Highest residual risk: rate-limit evasion across prefixes — a cost problem, not a privacy one
• Novel spam and novel prompt injection can degrade ranking but cannot break search
• DNS and application proxies the crawler cannot see remain outside LYNX's control
• Provider-level log access is outside LYNX's control and stated as such

The Rust toolchain is pinned to an exact version, unsafe code is forbidden workspace-wide, and dependencies are audited and licence-checked on every pull request.

• SBOMs published per release
• Container images pinned by digest, signed with cosign
• CI actions pinned by commit SHA
• Secret scanning with gitleaks
• Fuzzing targets for the DOM, JSON-LD, charsets, links, URL parsing and redirect resolution

There is no code to attack yet — the project is in its design phase. These are the risks the design accepts on purpose, stated before implementation rather than after an incident.