Security Policy

The platform uses server-side authorization, scoped organization access, protected authentication flows, bounded public projections, input validation, security headers, rate limits where applicable, and privacy-aware error and telemetry handling.

Security controls are continuously reviewed. Source checks, local tests, and a successful deployment do not by themselves prove every hosted provider or runtime control is healthy.

Use a unique password, keep recovery channels under your control, review unexpected sign-in or organization activity, and report suspected account takeover quickly. MoryaOS will not ask for an OTP or password by email or phone.

Send suspected vulnerabilities to security@moryaos.com. Include the affected URL or feature, a concise description, safe reproduction steps, and the minimum evidence needed to validate the issue. Remove secrets, tokens, personal data, and unrelated account information before sending.