We take the security of Ground Control (GCTRL) seriously. Thank you for helping keep GCTRL and its users safe.
Please report security issues privately — do not open a public GitHub issue.
Email fabio@5monti.com (or security@5monti.com if set up for your tenant) with:
- a description of the issue and its impact,
- steps to reproduce (proof-of-concept if possible),
- affected component/version, and
- any suggested remediation.
We will acknowledge your report, work with you on a fix, and coordinate disclosure. Please give us reasonable time to release a fix before any public disclosure. We're happy to credit you for the report unless you prefer to remain anonymous.
GCTRL ships as a rolling release. Security fixes are applied to the latest
released images (ghcr.io/gctrl-tech/*:latest). Always run the latest version —
update with:
curl -fsSL https://gctrl.tech/update | bashGCTRL is designed to run on your own infrastructure and keeps data local by default. Operator-side hardening (don't expose the data-layer ports, per-install database passwords, securing the API for remote agents) is documented in Securing Your Deployment.
In scope: the GCTRL platform services (api, agent, kex, fuse, web, portal, license-api) and the install/update scripts. Out of scope: vulnerabilities in third-party dependencies that are already publicly known and tracked upstream (please report those upstream), and issues that require an already-compromised host or physical access.