Security is a top priority for this project, especially given its role in automating CIS Benchmark hardening for Debian 13. I am committed to maintaining a secure environment for all users and appreciate the community's help in identifying potential vulnerabilities.

Only the latest version on main is actively supported and receives security updates.

The preferred way to report a vulnerability is via the GitHub Security Advisories feature. This ensures your report remains private while I work on a fix.

If you are unable to use GitHub Advisories, you may contact me directly at security@n1ght.fr.

To help me investigate and resolve the issue efficiently, please provide:

• Description — A clear and concise summary of the vulnerability
• Affected component — Which script or module is affected? (e.g. 2_privilege.sh)
• Steps to reproduce — Detailed instructions, including commands or configuration used
• Impact — What is the potential risk or consequence for a system running Hard4U?
• Version — The specific version or commit you are using
• Suggested fix (optional) — Any patches or remediation ideas you may have

I follow a Responsible Disclosure process:

As I maintain this project as a solo developer, resolution time may vary depending on the complexity of the issue. I am committed to addressing verified vulnerabilities as quickly as possible.

Once a fix is verified and released, a security advisory will be published on the repository to inform all users. Contributors who help identify and resolve security issues will be formally credited in the advisory and release notes, unless they prefer to remain anonymous.

• Logic errors in remediation scripts that could weaken security instead of hardening it
• Privilege escalation risks introduced by the scripts themselves
• Incorrect or dangerous CIS rule implementations
• Hardcoded sensitive values (passwords, keys) accidentally left in scripts

• Upstream Debian vulnerabilities — Issues inherent to Debian packages themselves should be reported to the Debian Security Team
• User configuration — Issues resulting from custom modifications or misuse of the tool after execution
• Theoretical vulnerabilities — Reports must be demonstrably exploitable or present a clear, logical security flaw within the provided code; unproven theoretical risks will not be considered

This project is developed on a voluntary, open-source basis. While I strive to ensure the highest level of quality and security, please note that response times depend on my availability as a solo maintainer.

I deeply value the work of security researchers who help improve this tool. While there is no formal bug bounty program, all contributors who help identify and resolve security issues will be acknowledged and credited in the project's security history and release notes.

Thank you for helping make the community safer. 🛡️