SoAI receives security support from 22 August 2026 through 22 August 2031. Security fixes are delivered through the same signed, numbered release path as other SoAI updates and are free of charge, regardless of whether an installation is personal, evaluation, or commercial.
The supported baseline is the latest available stable SoAI release. To remain supported, update to that release; superseded releases are not maintained for feature parity or guaranteed separate security fixes.
Check updates and read advisories
- In the SoAI WebUI, open the Settings menu at the right of the header, then Updates. This requires Software updates (
SOFTWARE_UPDATE). - Select Check for updates.
- Review the current version, available version, release notes, and platform support shown on the page.
- On a supported Linux, macOS (experimental), or Windows installation, select Install update and confirm the dialog.
- Wait for the updating screen to reconnect after SoAI restarts.
The updater authenticates the signed release manifest and verifies the selected artifact before installation. It
keeps the last valid installation when verification or installation fails. Update checks require public-network
access and are unavailable while
SYSTEM.RUNTIME.STAY_OFFLINE is
enabled. Linux and macOS use manifest-authenticated complete archives, while Windows uses the current manifest-authenticated x64 installer record. See
Updating SoAI for platform-specific installation, backup, and recovery steps.
Read advisories
Open the SoAI repository, then select
Security > Advisories for public advisories. They are also referenced by
Release notes and upgrade notices. The support period and software bill of
materials are recorded in SECURITY.md at the repository root.
Report vulnerabilities and understand response targets
Email security@soai.to with the subject SoAI security report. Include the affected version or revision, platform, prerequisite access, reproduction steps, impact, and a safe proof of concept. Do not send live credentials, private user data, or a destructive payload. Ask for a secure transfer method before sending sensitive attachments.
Do not open a public issue with exploit details or publish an undisclosed vulnerability. Test only systems and data you own or are explicitly authorized to test. The policy excludes denial-of-service testing, persistence, social engineering, data exfiltration, and testing against other users.
Response targets
| Stage | Target |
|---|---|
| Acknowledge receipt | 5 business days |
| Initial assessment and severity decision | 10 business days |
| Fix or documented mitigation for a confirmed high or critical issue | 90 days |
| Public advisory | When the fix ships, or 90 days after acknowledgement, whichever comes first |
These are coordinated-disclosure targets, not a paid support service level. An actively exploited issue is treated as critical. Reporter credit is available on request.