Security policy

Stratos is a local development tool. It runs services on your machine and binds them to 127.0.0.1 by default — services are not reachable from the network unless you explicitly start a tunnel.

Reporting a vulnerability

Please email security@stratos.app with a description and a reproducer. We aim to acknowledge reports within 48 hours and ship a fix or mitigation within 14 days for critical issues.

Please do not discuss suspected vulnerabilities publicly until a fix is shipped.

What Stratos is not

• Stratos is not a production web server. Do not expose it to the internet without a Cloudflare tunnel and authentication in front of your app.
• The MySQL/MariaDB root account has no password by default. This is appropriate for a local-only environment and dangerous if the port is exposed.
• Self-signed certificates are useful for browsers, but you should not use them for any cross-machine traffic.

Privileged helper

On first launch, Stratos installs a small privileged helper to bind low ports (80, 53) and to set up the local DNS resolver. The helper is shipped in the app bundle. Its only actions are:

• Install the /etc/resolver/test file pointing to the bundled dnsmasq.
• Bind low ports via macOS's pf packet filter when the user is not an admin.
• Start and stop the bundled services.

The helper never transmits data off the machine. The exact list of operations it can perform is documented inStratos.app/Contents/Resources/Helper/MANIFEST.plist.