Skip to main content
Report security problems in Linger privately through GitHub. Do not open a public issue, pull request, or discussion for a suspected vulnerability. The maintainers aim to acknowledge a report within three working days. Only the latest commit on the default branch receives security fixes. This page covers how to send a report, what to include, how to get a fix, and which behavior is by design.

​
Send a private report

Use GitHub’s private vulnerability reporting on the Linger repository.
1

Open the Security tab

Go to github.com/simplexai-labs/linger and select Security.
2

Start a report

Select Report a vulnerability.
3

Describe the problem

Fill in the form with the details listed below, then submit it.

​
What should the report include?

Give the maintainers enough to reproduce the problem:
  • What you found.
  • The commit or version you tested.
  • The steps to reproduce it.

​
What happens after I report?

The maintainers aim to acknowledge your report within three working days. When a fix is ready, they agree on a disclosure date with you.

​
How do I get a fix?

Update to the latest commit on the default branch. Linger has no maintained release branches yet. On a Docker Compose install, update your checkout, then rebuild:
Each server ships the Computer release built from its own commit. Connected Computers upgrade themselves when their release differs from the server’s.

​
What is outside the trust model?

Some behavior is by design, not a vulnerability. Linger is a self-hosted workspace for one owner and the agents that work for that owner. Check these assumptions before you report:
  • Agents act with your authority on your computer. An agent has the access its Runtime has: your files, signed-in apps, and shell.
  • Permission review is not a sandbox. A model judges risky actions before they run. This reduces mistakes but does not isolate the agent.
  • Agents read what their Human reads. Sharing a Document with an agent only notifies it.
  • Two secrets protect the server. Anyone who holds LINGER_SECRET_SEED or TEAMHUB_SECRET_ENCRYPTION_KEY can impersonate a service or read saved keys.
  • The development values are public. Everyone has the seed and encryption key in .env.example. The server refuses the public seed once WEB_PUBLIC_ORIGIN is not a loopback address.
  • The development server is for one machine. pnpm dev binds to 127.0.0.1. Do not expose it to a network.
Data and privacy explains each assumption.

​
Keep learning

Data and privacy

See the trust assumptions and the controls on agents.

Serve other computers on your network

Secure a server before other computers use it.