Security and Responsible Operation

LifeRaft OS is self-hosted software. Security therefore combines platform safeguards, timely LifeRaft OS updates, and the way each customer operates their own server, accounts, integrations, and data.

Security is treated as an ongoing operating practice—not a claim that any internet-facing system is invulnerable.

What LifeRaft OS Provides

• Permission-aware core and add-on workflows.
• Request validation, output escaping, CSRF protection, and guarded administrative actions.
• Account security controls that can be strengthened with RLX MFA and related safety add-ons.
• Storage and upload boundaries designed for self-hosted PHP deployments.
• Audit, privacy, retention, backup, and defensive add-ons that can be selected for the needs of a particular installation.
• Release verification and regression testing across the core and registered add-on catalog.

Public documentation explains these protections at a useful product level. Exact defensive rules, private routes, signing details, secrets, infrastructure topology, and customer-specific configurations are intentionally excluded.

Recommended Deployment Baseline

Every production operator should:

1. Use a currently supported PHP release and keep the operating system, web server, PHP runtime, and dependencies patched.
2. Serve the site through HTTPS with a valid certificate and modern TLS configuration.
3. Keep writable storage, backups, secrets, and operational files outside public web access wherever the hosting layout permits.
4. Grant the web process only the filesystem and database permissions it needs.
5. Protect administrator accounts with unique passwords and multi-factor authentication.
6. Restrict upload types and sizes to the formats genuinely required by the installed workflows.
7. Maintain tested, versioned backups and confirm that restoration works before an emergency.
8. Review logs, failed sign-ins, administrative activity, storage growth, and update status on a regular schedule.
9. Remove unused add-ons and integrations rather than leaving inactive code or credentials in place.
10. Test upgrades in a development or staging copy before applying them to a busy production community.

Shared Responsibility

Realystic maintains LifeRaft OS core and official RLX add-on code, release guidance, and eligible updates within the applicable license and support period.

The site operator remains responsible for the server, network, DNS, email, backups, credentials, administrator access, installed third-party code, external services, payment-provider configuration, uploaded content, privacy choices, moderation, and local legal obligations. Security add-ons support that work; they do not replace careful server administration.

Reporting a Security Concern

Please report a suspected LifeRaft OS or official RLX add-on security issue privately through the contact address on this site. Include the affected product and version, a concise description, safe reproduction details, and the potential impact.

Do not access other users' data, disrupt a live service, publish sensitive details, or test infrastructure without the owner's explicit permission. Reports are reviewed in context, and responsible coordination is appreciated. A public bounty or reward should not be assumed unless it has been agreed in writing before testing.

Claims We Deliberately Avoid

LifeRaft OS does not describe itself as unhackable, breach-proof, or immune to attack. It also does not publish customer firewall rules, live defensive telemetry, server addresses, private endpoint contracts, or exploit-specific operating details as marketing material.

The goal is quieter and more useful: sensible defaults, layered safeguards, honest boundaries, maintainable updates, and clear guidance for the people operating each self-hosted installation.