Security policy

Reporting a vulnerability

Please do not open a public issue for a suspected vulnerability.

Use GitHub's private vulnerability reporting from the repository's Security → Advisories → Report a vulnerability page:

https://github.com/iml885203/orbit/security/advisories/new

Include the affected version or commit, operating system, reproduction steps, impact, and any suggested mitigation. You should receive an acknowledgement within seven days. Please allow time for a fix and coordinated disclosure before publishing details.

Supported versions

Security fixes ship in the latest 1.x release and on main. Older releases are not patched; upgrade to the latest release to receive a fix.

Scope

Orbit manages local processes, containers, project configuration, and credentials supplied through the user's environment. Reports about unintended network exposure, command execution, secret disclosure, unsafe file access, or destructive behavior are in scope.

Local trust boundary

The dashboard and its HTTP API bind to loopback only. TCP requests must use a loopback Host; state-changing browser requests must also be same-origin. These checks block DNS rebinding and cross-site requests from driving local resource controls. The CLI uses the local Unix socket instead of the browser-facing TCP listener; that socket is readable and writable only by its owning operating-system user.

Orbit is a single-user local development tool, not a multi-user authorization server. Other processes running as the same operating-system user remain inside its trust boundary.