If you discover a security vulnerability in USAF itself (not a finding detected by USAF), please report it privately by opening a security advisory at:

https://github.com/Type-3-studio/usaf/security/advisories/new

Or email the maintainers directly. Please do not open public issues for security vulnerabilities.

USAF detects security misconfigurations, compromise indicators, and hardening gaps on Ubuntu systems. See src/usaf/checks/ for the full catalog of checks.