Security policy

Stratos is a local development tool. It runs services on your machine and binds them to 127.0.0.1 by default — services are not reachable from the network unless you explicitly start a tunnel.

Reporting a vulnerability

Please email security@stratos.app with a description and a reproducer. We aim to acknowledge reports within 48 hours and ship a fix or mitigation within 14 days for critical issues.

Please do not discuss suspected vulnerabilities publicly until a fix is shipped.

What Stratos is not

• Stratos is not a production web server. Do not expose it to the internet without a Cloudflare tunnel and authentication in front of your app.
• The MySQL/MariaDB root account has no password by default. This is appropriate for a local-only environment and dangerous if the port is exposed.
• Self-signed certificates are useful for browsers, but you should not use them for any cross-machine traffic.

Privileged network setup

On first launch, macOS displays its standard administrator prompt so Stratos can configure low-port redirects and the local DNS resolver. Stratos does not install a persistent privileged daemon. The approved setup performs only these actions:

• Install the /etc/resolver/test file pointing to the bundled dnsmasq.
• Bind low ports via macOS's pf packet filter when the user is not an admin.
• Enable the dedicated com.apple/stratos packet-filter anchor.

These commands do not transmit data off the machine and can be removed from Stratos settings.