Skip to content

Security: auditmate-software/auditmate

Security

SECURITY.md

Security Policy

Overview

AuditMate is designed to be a read-only, offline system auditing tool. It does not download data, phone home, auto-update, or modify system configuration.

Security is a core design principle.


What AuditMate Does

  • Executes local, OS-provided commands (e.g. systemctl, ss, ufw, PowerShell)
  • Reads system state (users, services, ports, packages, firewall status)
  • Writes output files locally (JSON baselines, reports)
  • Exits with deterministic exit codes for automation

What AuditMate Does NOT Do

  • ❌ No network connections
  • ❌ No telemetry or analytics
  • ❌ No automatic updates
  • ❌ No privilege escalation
  • ❌ No configuration changes
  • ❌ No vulnerability exploitation or scanning
  • ❌ No remote execution

Trust Model

  • Free version is fully open source and auditable
  • Users can build from source to verify integrity
  • Distributed binaries can be verified using SHA256 checksums
  • All collectors are OS-specific and transparent

Reporting a Vulnerability

If you believe you have found a security issue:

📧 Email: audit-mate@proton.me

Please include:

  • OS and version
  • AuditMate version or commit hash
  • Steps to reproduce (if applicable)

We aim to acknowledge reports within 72 hours.


Supported Versions

  • Latest release of the Free (open-source) version
  • Premium versions are supported via private channels

Thank you for helping keep AuditMate secure.

There aren’t any published security advisories