// security contact
Tell us about security problems privately
If you find a weakness in steakOS that could put someone’s business data at risk, please email us in private. Do not post exploit details in a public forum first.
Where to write
Email security@steakos.org.
We read English and German. There is also a short machine-readable note at
/.well-known/security.txt
for tools that look up security contacts automatically.
Helpful reports include: which version you used (if you know it), what went wrong, who could be hurt, and safe steps to show the issue. You do not need to send attack code.
How fast we aim to reply
These are good-faith targets for early practice — not a paid service contract and not a bug bounty.
| Step | Target |
|---|---|
| We acknowledge your mail | Within 3 business days |
| We judge how serious it is | Within 10 business days |
| Critical issues | We work to fix or warn as soon as we reasonably can |
What is in scope
- In scope: the steakOS core program and the documented ways to install and configure steakOS itself.
- Usually out of scope: other people’s tools you plug in (payment nodes, chat bots, operating-system hardening, third-party wallets or cloud accounts) — unless our connection code leaks passwords or customer data.
steakOS was built with security, privacy, and resilience as first goals — a decentralized system you run yourself — but no software is perfect. Private reports help every farm, workshop, and restaurant that depends on it.