We take security seriously. If you discover a security vulnerability, please follow these steps:

Security vulnerabilities should be reported privately.

Send details to: security@sentientos.dev

Include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

We follow responsible disclosure:

• We'll work with you to understand and fix the issue
• We'll credit you in the security advisory (unless you prefer to remain anonymous)
• We ask that you don't disclose the issue publicly until we've released a fix

SENTIENT OS includes multiple security layers:

┌─────────────┐      ┌─────────────┐      ┌─────────────┐
│   SENTIENT  │      │   V-GATE    │      │   LLM API   │
│   Client    │─────▶│   Proxy     │─────▶│   Provider  │
└─────────────┘      └─────────────┘      └─────────────┘
                           │
                     API Key (Secure)
                     Stored on server
                     NEVER in client code

V-GATE Features:

• Request routing & load balancing
• Rate limiting
• API key injection (server-side only)
• Encrypted key storage
• Key rotation support

Desktop agent için 50+ yasaklı komut:

✗ YASAKLI: rm -rf, format, dd, chmod 777, curl | bash,
           sudo, su, chown root, mkfs, shutdown, reboot
✓ İZİN VERİLEN: libreoffice, firefox, vscode, git, cargo

• Memory Safety: Rust guarantees memory safety at compile time
• No unwrap(): All code uses proper error handling with .expect() or ?
• Minimal unsafe: Only 10 unsafe blocks, all FFI-required
• Encrypted Storage: AES-256-GCM for sensitive data
• Audit Logging: Complete audit trail for compliance

1. Never commit API keys - Use V-GATE or environment variables
2. Enable encryption - Use sentient_vault for secrets
3. Regular updates - Keep SENTIENT OS updated
4. Audit logs - Monitor sentient_compliance audit logs

1. Run security audit before commits:

   cargo audit
   cargo clippy -- -W clippy::all

2. Check dependencies:

   cargo outdated
   cargo deny check

3. Format code:

   cargo fmt --all -- --check

• API keys are transmitted to LLM providers
• Use V-GATE to keep keys server-side
• Consider self-hosted models (Ollama, GPT4All) for sensitive data

• Default port: 8080
• Enable authentication for production
• Use HTTPS in production

• Plugins run in sandboxed environment
• Review plugin code before installation
• Use sentient_plugin security features

• Security Team: security@sentientos.dev
• PGP Key: security.asc
• GitHub Security: Security Advisories

Last Updated: April 2026

Next Review: July 2026