If you discover a security vulnerability, please report it responsibly:

1. Do NOT open a public GitHub issue
2. Email security@defensia.cloud with details
3. Include steps to reproduce if possible
4. We will respond within 48 hours

We appreciate responsible disclosure and will credit reporters (with permission) in the release notes.

The agent requires root privileges for two reasons: reading auth logs and managing iptables rules. Here is the complete list of resources it accesses:

The agent does not access: application source code, databases, environment variables, SSH keys, user files, or any data outside of log files and network state.

All communication uses HTTPS (TLS 1.2+).

Transmitted to your dashboard:

• Heartbeats (every 30s): hostname, IP, OS, agent version
• Security events: attacker IP, attack type, severity, timestamp
• Ban reports: banned IP, reason, duration
• Scan results: hardening check pass/fail status

Never transmitted:

• Raw log file contents (only parsed attack metadata)
• Application source code or file contents
• Environment variables, secrets, or credentials
• Database content or user data
• SSH keys or passwords

No data is shared with third parties by default.

Every release is built by GitHub Actions CI with full build provenance attestation. Binaries are signed with Cosign.

# Download checksum file from the release
curl -sL https://github.com/defensia/agent/releases/latest/download/checksums.txt

# Compare with your installed binary
sha256sum /usr/local/bin/defensia-agent

cosign verify-blob \
  --key https://raw.githubusercontent.com/defensia/agent/main/cosign.pub \
  --signature https://github.com/defensia/agent/releases/latest/download/defensia-agent-linux-amd64.sig \
  /usr/local/bin/defensia-agent

gh attestation verify defensia-agent-linux-amd64 --repo defensia/agent

Complete removal with no residual system changes:

curl -fsSL https://defensia.cloud/install.sh | sudo bash -s -- --uninstall

Or manually:

sudo systemctl stop defensia-agent
sudo systemctl disable defensia-agent
sudo rm /usr/local/bin/defensia-agent
sudo rm -rf /etc/defensia/
sudo iptables -F DEFENSIA 2>/dev/null
sudo iptables -D INPUT -j DEFENSIA 2>/dev/null
sudo iptables -X DEFENSIA 2>/dev/null

The agent only creates a dedicated DEFENSIA iptables chain. Removing it restores your firewall to its pre-installation state. No cron jobs, no kernel modules, no system-wide configuration changes.

We recommend always running the latest version. The agent auto-updates from GitHub Releases by default.