Security at Anteirus
Who is responsible for security at Anteirus, what that work covers, how to report a vulnerability to us, and the rules we follow when we do security research on our own software.
Security responsibility
Avnish Maha James Ranchigoda, Founder and Director, is responsible for Anteirus Technologies Corporation’s internal security work and vulnerability reporting. Contact: security@anteirus.com.
Anteirus is a founder-led company. Its internal security function is carried out by the founder; there is no separate security team.
Scope
This policy, and the internal security work it describes, covers the software and services Anteirus owns or maintains.
In scope
- Anteirus Terminal, the Anteirus-maintained terminal project previously referred to as Terminus: its source code, its internal builds and the components they include.
- Tooling Anteirus maintains to build, test and run Anteirus Terminal.
- anteirus.com, its subdomains, and the tooling that builds and publishes this site.
- Anteirus products and services where they are reachable by you.
Out of scope
- Issues in third-party software that do not affect Anteirus software. Please report those to the software’s maintainers.
- Third-party services we rely on (report to the provider)
- Denial of service, spam, or resource exhaustion
- Social engineering or physical attacks on people or premises
- Findings that require a compromised device or account
Our internal security work also covers the environments used to build, test and run Anteirus Terminal and this site: our development computers, the cloud server we use for builds and agents, and the hosting, DNS and email accounts behind anteirus.com.
Findings that also affect software maintained by others are coordinated with its maintainers before any publication.
Good-faith research means: no privacy violations, no destruction of data, no interruption of service, no access beyond what demonstrates the issue, and reasonable time to fix before public disclosure. We ask for 90 days, and we will tell you early if we need longer or can release sooner.
Reporting a vulnerability
Email is the only reporting channel.
If you believe you have found a security issue in anteirus.com, in Anteirus Terminal, or in other software we maintain, email security@anteirus.com. Our machine-readable contact record is published at /.well-known/security.txt (RFC 9116).
Please include the affected component, version or URL, steps to reproduce, and the impact you believe it has. Proof-of-concept material is welcome; access to data that is not yours is not — stop at the point that demonstrates the issue.
What we commit to. Acknowledgement within three business days. A named contact for the duration. Status updates at least every two weeks until resolution. Credit on this page if you want it. No legal action against research conducted in good faith under this policy.
Research and remediation practices
Security research on our own software is part of engineering at Anteirus. These are the rules it follows.
Owned or authorized targets only
Every target is software we own or hold written authorization to assess, and each engagement has a written scope record before work starts.
Isolated execution
Reproduction and validation of any exploitable finding must happen in disposable virtual machines or containers with networking disabled or host-only — never on production systems, never on systems that belong to anyone else.
Human review of every finding
Every finding is reviewed by a person before remediation or disclosure. Automated tooling, including AI-assisted analysis, proposes; a person decides.
Remediation
A confirmed issue in Anteirus code must be fixed in our source and retested against the original reproduction before the report is closed, and the reporter hears from us before closure.
Coordinated disclosure
Anything that affects software maintained by others is disclosed in coordination with its maintainers.
No offensive use
We do not build or operate malware, persistence mechanisms or attack infrastructure, and we do not test systems we do not own.
Evidence
What you can inspect today, stated plainly.
Security contact record
/.well-known/security.txt follows RFC 9116. It names security@anteirus.com and points to this page as the policy.
Published assessments
None yet. We have not published an assessment report. When we complete an assessment that is suitable for publication, it will be listed here with the component and version, the date, the method, the result, and any remediation and retesting.
Certifications and independent review
Anteirus holds no third-party security certifications, and no independent security assessment of Anteirus or its software has been carried out. If your evaluation needs one, tell us.
Policy history
Changes to this policy are dated here.
24 October 2026
Revised. The product is now called Anteirus Terminal (previously referred to as Terminus). The responsibility statement was updated. The scope now lists Anteirus Terminal, the tooling used to build, test and run it, anteirus.com and its tooling, and the environments the internal work covers, and it excludes issues in third-party software that do not affect Anteirus software. The isolated-execution rule is now worded as a requirement. A remediation rule (new), the evidence section and this history were added. The commitments under “What we commit to” are unchanged.
27 August 2026
First published.
Anteirus Technologies Corporation · Texas, United States · Policy last reviewed 24 October 2026