> ## Documentation Index
> Fetch the complete documentation index at: https://docs.heylinger.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Report a vulnerability

> Report a security problem in Linger privately, and know which versions receive fixes.

Report security problems in Linger privately through GitHub. Do not open a public issue, pull request, or discussion for a suspected vulnerability.

The maintainers aim to acknowledge a report within three working days. Only the latest commit on the default branch receives security fixes. This page covers how to send a report, what to include, how to get a fix, and which behavior is by design.

## Send a private report

Use GitHub's private vulnerability reporting on the Linger repository.

**1. Open the Security tab**

Go to [github.com/simplexai-labs/linger](https://github.com/simplexai-labs/linger) and select **Security**.

**2. Start a report**

Select **Report a vulnerability**.

**3. Describe the problem**

Fill in the form with the details listed below, then submit it.

## What should the report include?

Give the maintainers enough to reproduce the problem:

* What you found.
* The commit or version you tested.
* The steps to reproduce it.

## What happens after I report?

The maintainers aim to acknowledge your report within three working days. When a fix is ready, they agree on a disclosure date with you.

## How do I get a fix?

Update to the latest commit on the default branch. Linger has no maintained release branches yet.

On a Docker Compose install, update your checkout, then rebuild:

```bash theme={null}
git pull
docker compose up --build --detach --wait
```

Each server ships the Computer release built from its own commit. Connected Computers upgrade themselves when their release differs from the server's.

## What is outside the trust model?

Some behavior is by design, not a vulnerability. Linger is a self-hosted workspace for one owner and the agents that work for that owner. Check these assumptions before you report:

* **Agents act with your authority on your computer.** An agent has the access its Runtime has: your files, signed-in apps, and shell.
* **Permission review is not a sandbox.** A model judges risky actions before they run. This reduces mistakes but does not isolate the agent.
* **Agents read what their Human reads.** Sharing a Document with an agent only notifies it.
* **Two secrets protect the server.** Anyone who holds `LINGER_SECRET_SEED` or `TEAMHUB_SECRET_ENCRYPTION_KEY` can impersonate a service or read saved keys.
* **The development values are public.** Everyone has the seed and encryption key in `.env.example`. The server refuses the public seed once `WEB_PUBLIC_ORIGIN` is not a loopback address.
* **The development server is for one machine.** `pnpm dev` binds to `127.0.0.1`. Do not expose it to a network.

[Data and privacy](https://docs.heylinger.com/security/data-and-privacy.md) explains each assumption.

## Keep learning

> [card] [Data and privacy](https://docs.heylinger.com/security/data-and-privacy.md)
>
> See the trust assumptions and the controls on agents.

> [card] [Serve other computers on your network](https://docs.heylinger.com/admin/network.md)
>
> Secure a server before other computers use it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.