Security fixes are applied to the current 1.x release line. Older snapshots and locally modified installations are not independently supported.

Do not disclose suspected vulnerabilities in a public issue. Report them privately to the repository owner through GitHub's private vulnerability reporting or security-advisory feature. Include:

• the affected version and operating system;
• the OS username and BBS operation involved;
• exact reproduction steps;
• relevant request_id values from the service journal;
• expected and observed behavior;
• impact and any known workaround.

Do not include private-message bodies, SSH private keys, passwords, bearer tokens, or uploaded media in a report.

• SSH authenticates the operating-system account. CataclysmBBS does not store passwords or SSH keys.
• The local service authenticates clients using Unix-socket peer credentials.
• BBS users can access the service socket but cannot access the private SQLite database or attachment store.
• Database statements are parameterized and user text is length-limited and stripped of terminal control characters.
• Uploads are bounded, chunked, renamed, stored outside user-controlled paths, and verified with SHA-256.
• Mail can be retrieved only by its sender or recipient. Inbox and sent deletion are per-user; a row is removed after both participants delete it.
• Built-in IRC-style chat has no public network listener or guest access. Personal history contains at most 500 lines seen during fresh authenticated presence and does not collect chat while the user is absent.
• Service logs record usernames and operation context but intentionally omit post bodies, private-message/chat bodies, file contents, tokens, and keys.
• Transfer paths must be absolute, resolve under the authenticated OS user's home, and cannot select symlinks; batches are capped at 50 files.
• Terminal-assisted upload requires the local terminal's user-approved iTerm2 or Kitty transfer protocol. iTerm2 intake accepts regular files only, rejects unsafe paths and links, sanitizes names, removes partial files, and caps each received selection at 50 files and 1 GiB before normal attachment checks. Unsupported and interrupted protocol sessions time out and restore the curses display.
• Terminal image viewing is opt-in, limited to image attachments of at most 8 MiB, and uses a checksum-verified temporary copy. Text-only remains the default and download fallback.
• OS-user creation/deletion from the TUI is limited by a generated sudoers rule to two guarded bb-admin command forms. Account deletion refuses the current administrator, root, and the service account, and preserves home directories.
• Board identity and forum/category, topic, post, and user administration require the exact admin role at the service boundary. Destructive category operations cannot remove the final forum, and opening posts must be managed through their topic.

Administrators should use SSH public-key authentication, disable unused accounts promptly, keep Debian security updates current, and review journalctl -u cataclysmbbs.service.