Buraaq 1.0
Security notes
Buraaq is a systems language and a native deploy toolchain. Use it on systems you own or are authorized to test. Do not abuse.
Legitimate use
Write programs. Compile them. Ship them to hosts you control. Fuzz the compiler on your machine. Report bugs. That is the intended loop.
You may not scan, flood, or break into Dock, Keel, or any host you do not operate. You may not use Buraaq to steal data, hide malware, or attack third parties. You may not treat Dock as a multi-tenant sandbox for untrusted code: isolation is a directory and a child process, not a VM.
Cooperation with agencies
Buraaq administration cooperates with lawful requests from law-enforcement and government agencies. We do not provide a platform for crime. We do not obstruct legitimate investigations.
Agencies with a lawful request: contact the founding author Asim. We respond in good faith. We do not publish exploit recipes. We do not assist unauthorized access.
What the toolchain already checks
- Every
.buris SHA-256 hashed. Tamper is a hard error. - Paths inside a ship cannot contain
... - Dock mutations require a bearer token. Default bind is localhost.
- Keel writes from a foreign origin need an API key. Health stays open.
- Safe Buraaq is memory-safe by default.
unsafeis the only gate for raw pointers.
Hash checks and tokens are not permission to attack. Test your own Dock. Leave other people's ports alone.
Reporting a vulnerability
Do not open public issues for exploitable compiler or runtime bugs. Include version, a .bq reproducer, and impact. Coordinated disclosure is preferred. We aim to acknowledge within 72 hours.
Never commit database URLs, dock tokens, or API keys. Put secrets on the host environment. Rotate anything that has leaked into a log or a chat.