Security

Report a vulnerability

Email hello@eddyline.app with the subject “Security”. Please include:

• the version, from eddy status
• what you found and where
• the steps to reproduce it
• whether you have shared it with anyone else

We answer within one business day. Please do not post details publicly until a fix has shipped.

Update policy

Self-hosted installs:

• eddy update takes a backup first, then updates.
• The daily update check tells staff on the settings page that a release exists. It does not install anything.
• Security fixes ship as patch releases.

Managed installs:

• We apply each release within 7 days.
• We apply a security fix within 2 business days.

Check the installer before running it

The one-line install pipes a script into sh. If you would rather check it first, download the script and its checksums, compare, read the script, then run it.

curl -fsSLO https://get.eddyline.app/install.sh
curl -fsSLO https://get.eddyline.app/SHA256SUMS
sha256sum --check --ignore-missing SHA256SUMS

The last command should print install.sh: OK. Read install.sh, then run it:

sh install.sh

Everything the installer runs is in the public sectorflow/eddy-releases repository, with older versions in its history.

What leaves the server

Eddyline sends SectorFlow no telemetry. The full list of outbound connections is in the privacy notice.