Do not open a public GitHub issue for security vulnerabilities.

Instead, please report security issues by emailing:

security@dyber.org

Include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

• 48 hours: Acknowledgment of your report
• 7 days: Initial assessment and severity classification
• 90 days: Fix developed, tested, and released

The following components are in scope:

• zernel-cli — CLI IDE binary
• zernel-ebpf — zerneld observability daemon
• zernel-scheduler — sched_ext CPU scheduler
• distro/ — kernel configuration and sysctl tuning

• Vulnerabilities in upstream dependencies (report to the respective project)
• Issues requiring physical access to the machine
• Social engineering attacks

We will credit security researchers in the release notes (with your permission).

Copyright (C) 2026 Dyber, Inc.