Found something? Tell us privately first.
HOW TO REPORT
One channel, and a fallback
Open a private security advisory on the repository the flaw is in. If GitHub is not workable for you, use the contact form and put [security report] in the message; we will move the conversation somewhere private before you send details.
What makes a report actionable
- The repository and the commit or version you tested.
- What an attacker gets, in one sentence.
- Reproduction steps, or a proof of concept we can run.
- Whether it needs physical access, network adjacency or a credential.
- Whether you have told anyone else.
We do not publish a PGP key
There is no security PGP key and no dedicated security mailbox, and we would rather say so than print an address that bounces or a key nobody holds. GitHub's private advisory flow is encrypted in transit, scoped to the repository maintainers, and gives you a thread that survives the fix.
SCOPE
What we want you to look at
- ADOSMissionControl
- in scope
- ADOSDroneAgent
- in scope
- ADOSExtensions
- in scope
- ADOSAndroidGCS
- in scope
- ADOS-MCP
- in scope
- command.altnautica.com
- in scope
- The extension signing chain
- in scope
- A self-hosted deployment you run
- yours to test freely
- Someone else's deployment or aircraft
- out of scope
Test against your own hardware and your own deployment. Do not fly someone else's aircraft, do not touch a fleet you were not invited into, and do not run a denial-of-service test against the hosted ground station. Vendored third-party code in our repositories should be reported to us as well, and we will carry it upstream.
TIMELINE
What happens after you send it
- Acknowledgement
- 3 working days
- Triage and severity
- 10 working days
- Coordinated disclosure
- 90 days
- Credit
- yours, unless you decline
Ninety days from acknowledgement to public disclosure, and sooner if the fix is out sooner. If a fix is going to take longer than that, we will tell you why and agree a date rather than let the clock run out silently. A flaw with a safety consequence in flight gets treated as the highest severity regardless of how hard it is to exploit.
SAFE HARBOUR
We will not come after you
Research conducted in good faith under this policy is authorised, and we will not pursue or support legal action against you for it. Good faith means: you tested your own hardware and accounts, you stopped at proof rather than pivoting further, you did not exfiltrate or destroy data that was not yours, you did not degrade a service other people depend on, and you gave us a reasonable window before going public. If you are unsure whether something is in bounds, ask first. We would rather answer a question than receive an apology.
There is no bug bounty programme and no acknowledgements page yet, so we are not going to promise either. What you get is credit in the advisory and the changelog, unless you would rather stay anonymous.
POSTURE
What the platform already does about untrusted code
A disclosure policy is the last line, not the first. Most of the attack surface here is third-party code running next to a flight controller, so that is where the mechanisms are.
Trust comes from a signature, not a claim
An extension archive is trusted only when its Ed25519 signature verifies against a public key already enrolled on that node, after a revocation-list check. Nothing inside the archive can assert its own trust, and in-process execution is restricted to a hardcoded first-party signer list held in source rather than in a config file.
Capabilities are enforced, not displayed
Host hardware, filesystem and network capabilities are applied as systemd restrictions on a generated unit. Wire-level capabilities are enforced by a code-generated dispatch gate on both the Rust host and the Python runtime. A guard test fails the build if the catalog and the mechanism disagree.
Revocation actually stops the code
Revoking a capability re-mints the running plugin's token so the next request re-gates, or re-renders the unit and restarts the plugin when the restriction is one systemd applies at exec time. An operator who revokes something sees it stop rather than seeing a success message.
The agent does not trust its own tooling
The MCP surface maps every route to a required scope fail-closed, so an unclassified write is denied rather than allowed. A process on the box is trusted for scope by presence, never for the safety gate. Simulation mode is verified against what the target reports, not accepted from a flag.