We take the security of NoID Privacy for Linux seriously. If you discover a security vulnerability, please follow responsible disclosure practices.

DO NOT create a public GitHub issue for security vulnerabilities.

Instead, please report security issues via one of these methods:

1. GitHub Security Advisory (Preferred)

   • Go to: https://github.com/NexusOne23/noid-privacy-linux/security/advisories
   • Click "Report a vulnerability"
   • Fill out the private security advisory form

2. GitHub Discussions (Alternative)

   • Create a new discussion in the Security category
   • Mark it as "Private" if possible
   • Provide full details

When reporting a vulnerability, please include:

• Description: Clear description of the vulnerability
• Impact: What can an attacker achieve?
• Affected Versions: Which versions are affected?
• Steps to Reproduce: Detailed reproduction steps
• Proof of Concept: PoC code if applicable (optional)
• Suggested Fix: If you have one (optional)

We appreciate responsible disclosure! Contributors will be:

• Credited in the CHANGELOG (if desired)
• Listed in the Security Hall of Fame (coming soon)

NoID Privacy for Linux is designed with security in mind:

• ✅ Read-Only: The script only reads system state — it never modifies your system

• ✅ Pure Bash core: No Python, Ruby, Node.js, or compiled binaries. Uses standard Linux utilities (most pre-installed) where needed.

• ✅ No Telemetry, No Analytics, No Phone-Home: Zero data collected about you or your system

• ⚠️ Network leak-tests run by default: Three sections issue 3rd-party DNS/HTTP requests to detect IP/DNS leaks:

  • Section 5 (vpn): curl detectportal.firefox.com (Mozilla), curl ifconfig.me (Cloudflare-fronted)
  • Section 5 (netleaks): dig whoami.akamai.net (Akamai)
  • Section 22 (interfaces): dig google.com (Google)

  These are inherent to leak-testing — you can't test for an IP leak without contacting an external service. For a fully offline audit, use:

  sudo bash noid-privacy-linux.sh --skip vpn --skip interfaces --skip netleaks

• ✅ Single File: One script, easy to read and audit
• ✅ Open Source: Every line is inspectable on GitHub
• ✅ No Obfuscation: Plain Bash, no encoded/minified code
• ✅ Deterministic: Same system state = same output

Recommendation: Use v3.6.5.

1. ✅ Review the Code (most important)

   # It's one file in pure Bash — read it!
   less noid-privacy-linux.sh

   This is the only meaningful integrity check. Don't trust hashes from untrusted sources — read the code yourself.

2. ✅ Check the Source

   • Download only from the official GitHub repository
   • Verify the URL: https://github.com/NexusOne23/noid-privacy-linux
   • For CI/CD usage: pin to a specific version (@v3.6.5), never @main

3. ✅ Verify against the GitHub repository commit hash

   # The script is one file in pure Bash. Verify you're getting it from
   # the official repo and inspect the commit history:
   git log --oneline noid-privacy-linux.sh | head -5
   # Or check the release tag against the live GitHub view:
   # https://github.com/NexusOne23/noid-privacy-linux/releases

   We do NOT publish SHA256 sums separately — the canonical integrity check is the GitHub commit/tag hash itself. Code review is the meaningful audit; hash-comparison from untrusted sources adds nothing.

• ⚠️ Requires root access (sudo) for comprehensive system checks
• ✅ The script only reads — it does not modify any files or settings
• ✅ All checks use standard Linux utilities (sysctl, ss, systemctl, etc.)

• ✅ Review the findings and fix issues manually or with AI assistance (--ai)
• ✅ Re-run periodically to verify your hardening holds
• ✅ Share reports with your team (no sensitive data in output by default)

• ⚠️ The script requires sudo to read certain system files (e.g., /etc/shadow permissions, firewall rules)
• ✅ Root access is used for reading only — no writes, no modifications
• ✅ The most reliable verification is human review: the script is one file in plain Bash. Open it in less and check what it does.

• ⚠️ The audit output contains details about your system's security posture
• ✅ Do not share raw output publicly if it reveals sensitive configuration
• ✅ The --json output is designed for automated processing, not public sharing

• ShellCheck: clean at --severity=style (the strictest level) — see .shellcheckrc for the project-wide rationale on SC2059 (color-format strings) and SC2329 (callback dispatch / signal traps). The CI gate enforces --severity=warning.
• API-Layer Lint: scripts/lint-api-usage.sh enforces 11 anti-regression patterns covering bug classes — direct firewalld API bypassing capability layer, systemctl is-masked (non-existent verb), grep -r on symlinked dirs, bare pass()/fail()/warn()/info() reintroductions, chage -l without LC_ALL=C, hardcoded VPN-iface regex, df -T NR==2 wrap-vulnerable patterns, fwupdmgr/bluetoothctl without LC_ALL=C, ((var<op>)) arithmetic-command counters that bomb under set -e (Pattern 9, all ++/--/+=/-=/*=//=/%= forms), systemd-analyze/virsh/resolvectl/free without LC_ALL=C (Pattern 10, free -flag forms covered), and unanchored grep nameserver on resolv.conf (Pattern 11, catches commented entries reported as active DNS servers).
• BATS unit tests: tests/unit/ covers the bug-pattern classes via bats runner against tests/fixtures/.
• bash -n: Syntax validation in CI across Ubuntu 22.04/24.04, Fedora 42/43/44, Debian 12, and Arch Linux (7-distro matrix). Plus a real audit-smoke test job that runs the audit on Ubuntu with --offline and validates JSON output parses.
• Audit-Locale Matrix: runs the audit under en_US, de_DE, fr_FR locales to catch the locale-bug class (chage/fwupdmgr/bluetoothctl translatable labels).
• Manual Review: Every PR is reviewed for security implications.

Run checks yourself:

# Syntax check
bash -n noid-privacy-linux.sh

# ShellCheck (if installed)
shellcheck noid-privacy-linux.sh

# API-layer lint
bash scripts/lint-api-usage.sh noid-privacy-linux.sh

# BATS unit tests
bats tests/unit/

No security vulnerabilities reported to date.

• NoID Privacy — Windows 11 Security & Privacy Hardening Framework (sister project)

• License: GNU General Public License v3.0
• Disclaimer: Use at your own risk. No warranties provided.
• Audit-Only: This tool does not modify your system.

For licensing questions, see LICENSE or open a Discussion.

Last Updated: May 18, 2026 Policy Version: 1.6.5