We take the security of NoID Privacy for Linux seriously. If you discover a security vulnerability, please follow responsible disclosure practices.

DO NOT create a public GitHub issue for security vulnerabilities.

Instead, please report security issues via one of these methods:

1. GitHub Security Advisory (Preferred)

   • Go to: https://github.com/NexusOne23/noid-privacy-linux/security/advisories
   • Click "Report a vulnerability"
   • Fill out the private security advisory form

2. GitHub Discussions (Alternative)

   • Create a new discussion in the Security category
   • Mark it as "Private" if possible
   • Provide full details

When reporting a vulnerability, please include:

• Description: Clear description of the vulnerability
• Impact: What can an attacker achieve?
• Affected Versions: Which versions are affected?
• Steps to Reproduce: Detailed reproduction steps
• Proof of Concept: PoC code if applicable (optional)
• Suggested Fix: If you have one (optional)

We appreciate responsible disclosure! Contributors will be:

• Credited in the CHANGELOG (if desired)
• Listed in the Security Hall of Fame (coming soon)

NoID Privacy for Linux is designed with security in mind:

• ✅ Non-remediating by default: normal audit mode intentionally changes no configuration, restarts no services, and never refreshes package metadata; invoked services may still record ordinary operational logs/access metadata

• ⚠️ Explicit stateful opt-ins: NOID_RPM_BASELINE_INIT=1 / NOID_RPM_BASELINE_UPDATE=1 writes /var/lib/noid-privacy/rpm-baseline.txt; NOID_AIDE_LIVE=1 creates a mode-600 temporary log and preserves it only for drift/errors

• ✅ Pure Bash core: No Python, Ruby, Node.js, or compiled binaries. Uses standard Linux utilities (most pre-installed) where needed.

• ✅ No Telemetry or Analytics: audit results are never uploaded; the documented leak-test requests still expose normal connection metadata to their endpoints

• ⚠️ Network leak-tests run by default: Three request groups in two sections issue 3rd-party DNS/HTTP requests to detect IP/DNS leaks:

  • Section 5 (vpn): ICMP ping 1.1.1.1 (Cloudflare) / 9.9.9.9 (Quad9) for connectivity, HTTP fallback curl cp.cloudflare.com/generate_204 (Cloudflare); plus pings to common LAN gateway addresses (local network only) for the kill-switch test
  • Section 5 (netleaks): dig whoami.akamai.net (Akamai) + curl https://ifconfig.me/ip (TLS public-IP echo service)
  • Section 22 (interfaces): dig . NS — a DNS root-server query through the configured resolver (no third-party domain)

  These are inherent to leak-testing — you can't test for an IP leak without contacting an external service. For a fully offline audit, use:

  sudo bash noid-privacy-linux.sh --offline
  # equivalent to: --skip vpn --skip interfaces --skip netleaks

• ✅ Single File: One script, easy to read and audit
• ✅ Open Source: Every line is inspectable on GitHub
• ✅ No Obfuscation: Plain Bash, no encoded/minified code
• ✅ Deterministic: Same system state = same output

Recommendation: Use v3.7.0.

1. ✅ Review the Code (most important)

   # It's one file in pure Bash — read it!
   less noid-privacy-linux.sh

   This is the only meaningful integrity check. Don't trust hashes from untrusted sources — read the code yourself.

2. ✅ Check the Source

   • Download only from the official GitHub repository
   • Verify the URL: https://github.com/NexusOne23/noid-privacy-linux
   • For CI/CD usage: pin to a specific version (@v3.7.0), never @main

3. ✅ Verify against the GitHub repository commit hash

   # The script is one file in pure Bash. Verify you're getting it from
   # the official repo and inspect the commit history:
   git log --oneline noid-privacy-linux.sh | head -5
   # Or check the release tag against the live GitHub view:
   # https://github.com/NexusOne23/noid-privacy-linux/releases

   We do NOT publish SHA256 sums separately — the canonical integrity check is the GitHub commit/tag hash itself. Code review is the meaningful audit; hash-comparison from untrusted sources adds nothing.

• ⚠️ Requires root access (sudo) for comprehensive system checks
• ✅ Default audit mode performs no intentional remediation; the explicitly documented baseline/AIDE opt-ins create audit-state files, while invoked daemons may maintain normal operational logs
• ✅ All checks use standard Linux utilities (sysctl, ss, systemctl, etc.)

• ✅ Review the findings and fix issues manually or with AI assistance (--ai)
• ✅ Re-run periodically to verify your hardening holds
• ⚠️ Review/redact reports before sharing: output can include hostname, usernames, paths, installed software, and security findings

• ⚠️ The script requires sudo to read certain system files (e.g., /etc/shadow permissions, firewall rules)
• ✅ Root access is used for reading in default mode; only the explicitly selected RPM-baseline/AIDE-live features write audit state
• ✅ The most reliable verification is human review: the script is one file in plain Bash. Open it in less and check what it does.

• ⚠️ The audit output contains details about your system's security posture
• ⚠️ Finding text can originate in untrusted filenames/configuration; control bytes are escaped and the AI prompt explicitly marks findings as data, but users must still review generated remediation
• ✅ Do not share raw output publicly if it reveals sensitive configuration
• ✅ The --json output is designed for automated processing, not public sharing

• ShellCheck: clean at --severity=style (the strictest level) — see .shellcheckrc for the project-wide rationale on SC2059 (color-format strings) and SC2329 (callback dispatch / signal traps). The CI gate enforces --severity=warning.
• API-Layer Lint: scripts/lint-api-usage.sh enforces 11 anti-regression patterns covering bug classes — direct firewalld API bypassing capability layer, systemctl is-masked (non-existent verb), grep -r on symlinked dirs, bare pass()/fail()/warn()/info() reintroductions, chage -l without LC_ALL=C, hardcoded VPN-iface regex, df -T NR==2 wrap-vulnerable patterns, fwupdmgr/bluetoothctl without LC_ALL=C, ((var<op>)) arithmetic-command counters that bomb under set -e (Pattern 9, all ++/--/+=/-=/*=//=/%= forms), systemd-analyze/virsh/resolvectl/free without LC_ALL=C (Pattern 10, free -flag forms covered), and unanchored grep nameserver on resolv.conf (Pattern 11, catches commented entries reported as active DNS servers).
• BATS unit tests: tests/unit/ covers the bug-pattern classes via bats runner against tests/fixtures/.
• bash -n: Syntax validation in CI across Ubuntu 22.04/24.04, Fedora 42/43/44, Debian 12, and Arch Linux (7-distro matrix). Plus a real audit-smoke test job that runs the audit on Ubuntu with --offline and validates JSON output parses.
• Audit-Locale Matrix: runs the audit under en_US, fr_FR, es_ES locales to catch the locale-bug class (chage/fwupdmgr/bluetoothctl translatable labels).
• Manual Review: Every PR is reviewed for security implications.

Run checks yourself:

# Syntax check
bash -n noid-privacy-linux.sh

# ShellCheck (if installed)
shellcheck noid-privacy-linux.sh

# API-layer lint
bash scripts/lint-api-usage.sh noid-privacy-linux.sh

# BATS unit tests
bats tests/unit/

No security vulnerabilities reported to date.

• NoID Privacy — Windows 11 Security & Privacy Hardening Framework (sister project)

• License: GNU General Public License v3.0
• Disclaimer: Use at your own risk. No warranties provided.
• Audit-Only: Default mode does not modify system configuration; explicit baseline/AIDE-live opt-ins write only their documented audit-state files.

For licensing questions, see LICENSE or open a Discussion.

Last Updated: July 11, 2026 Policy Version: 1.7.0