DINX is a public alpha. Do not use it on systems or with data that cannot be restored.

Security fixes target the current main branch and the latest documented alpha workflow output. Older ISO artifacts are not security-supported releases.

Do not open a public issue for an undisclosed vulnerability. Use GitHub's private vulnerability reporting form:

https://github.com/rufl/DINX/security/advisories/new

Include:

• affected commit, workflow run or artifact;
• host and guest architecture;
• exact reproduction steps;
• impact and required privileges;
• logs or a minimal proof of concept with secrets removed.

If private reporting is unavailable, contact the repository owner through the GitHub profile and do not publish the details until a fix or mitigation is coordinated.

• The live image automatically opens the disposable dinx account in Aqueous + Pearl (DINX); installed/manual login uses Pearl Greeter through greetd and the dedicated pearl-greeter account. The Greeter is not an authentication boundary for the live image: physical boot access already grants control of that machine. The public dinx password remains only as a diagnostic fallback if the live session is started manually. Never reuse it elsewhere.
• Verify the ISO checksum before writing removable media or booting it.
• Do not place production credentials, personal data or private keys in the live session.
• A successful boot is not evidence of production security, persistence safety or update safety.

See the security model and installation guide for operational guidance.