Product security
Onuri Antivirus inspects hostile input by design. Its architecture assumes every scanned file is trying to attack the scanner.
- Read-only scanning. Scanned files are only ever read as bytes. They are never executed, imported, or decompressed and run.
- Memory safety. The whole Rust workspace is compiled with
#![forbid(unsafe_code)]. - Resource limits. 200 MB maximum file size, archive nesting depth of 3, and a 100:1 decompression ratio cap stop zip bombs and resource-exhaustion attacks.
- No panics on bad input. Errors are typed, and malformed input produces an error, not a crash.
- Continuous fuzzing. Every parser (lockfiles, git objects, archives, rule files) has a
cargo-fuzztarget. - Tamper-resistant configuration. Config lives in the per-user config directory, never inside a project, so a scanned repo or an AI agent working in it can't change how it is scanned. Agent-guard settings can only be changed in the Onuri app itself.
Supply chain
We scan our own code with Onuri on every change, with zero accepted findings on our workspace. Dependencies are pinned through Cargo.lock and checked against OSV.dev. We avoid licences and data sources that would put customers at legal risk, and we credit rule authors where licences require it.
Signed updates
The desktop app checks onurilabs.com for updates over HTTPS. Each update package is signed with an Ed25519 key held offline, and the app verifies that signature against the public key built into it before installing. Updates install only after you click. A failed or tampered update is rejected, and the current version keeps running.
Data handling
| What | Leaves your machine? |
|---|---|
| File contents, source code | ■ never |
| Secrets found in scans | ■ never — they are redacted even in local output |
| Package names + versions | Only with online checks on, sent to OSV.dev and the package registries. Off with --offline. |
| Update check | App version, OS and architecture, sent to onurilabs.com |
| Feedback reports | Only when you press send. You see the exact JSON first. Diagnostics are opt-in per report. |
| Usage telemetry | ■ none |
See the privacy policy for details.
Infrastructure
- All traffic to
onurilabs.comis HTTPS-only, with TLS 1.2+ and HSTS. - The site is served behind Cloudflare with DDoS protection, and sends strict security headers (CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy).
- The website loads no third-party scripts, trackers or ad pixels. Fonts are self-hosted.
- Release signing keys are kept offline and never stored on build or web servers.
- Administrative accounts require multi-factor authentication.
Vulnerability disclosure
If you believe you've found a security vulnerability in an Onuri Labs product or in onurilabs.com, please tell us. We welcome reports from everyone.
Please include the affected product and version, steps to reproduce, and the impact you observed. A proof of concept helps a lot.
What to expect
| Step | Target time |
|---|---|
| Acknowledgement of your report | 2 business days |
| Initial assessment and severity | 5 business days |
| Fix for critical issues | 7 days |
| Fix for high issues | 30 days |
| Public advisory and credit | Once a fix ships, coordinated with you |
In scope
- Onuri Antivirus desktop app and
onuriCLI (current release) - The update and feedback endpoints under
onurilabs.com/api onurilabs.comand its subdomains- Detection bypasses that let malicious content evade a shipped rule are welcome too, as regular reports
Out of scope
- Denial-of-service or volumetric testing
- Social engineering, phishing or physical attacks against staff
- Findings from automated scanners with no demonstrated impact
- Missing best-practice headers on pages with no sensitive functionality
- Vulnerabilities in third-party services we don't control
Safe harbor
We will not pursue legal action against anyone who researches and reports vulnerabilities in good faith under this policy. That means you:
- avoid privacy violations, data destruction and service disruption,
- only access the data you need to show the vulnerability, and delete it afterwards,
- give us reasonable time to fix the issue before telling anyone else, and
- don't exploit the issue beyond what's needed to confirm it.
If you're unsure whether something is allowed, email us first.
Security advisories
No security advisories have been published for Onuri products. Advisories and fixes will appear here and in the changelog, with credit to the reporter if they want it.