Security release 1.5.0 · 22 September 2026
A full scan of the running system, the source tree, the kernel configuration and the update server was performed on 22 September 2026. Every weak default it found was fixed the same day; the fixes ship as release 1.5.0.
Protection on the device
Encrypted by default
Full-disk encryption with hardware inline crypto is forced on; the data partition is never mounted unencrypted.
USB restricted mode 1.5.0 default
A locked phone refuses new USB devices, so a cable cannot be used to extract data or inject input while you are not there. Enforced in the kernel through the Trust interface.
Auto-reboot when locked
After a chosen time locked, the phone restarts so the encryption keys leave memory. A phone that has been left alone is at its strongest state.
Erase after failed unlocks 1.5.0 opt-in
Ten wrong unlock attempts and the phone erases itself, performed by the platform's own device-policy engine. Off unless you turn it on, with a full warning first.
Lock-screen privacy 1.5.0 default
Notification content stays hidden until the phone is unlocked.
Per-app network control
Cut any app off from Wi-Fi or mobile data with one switch; the kernel firewall enforces it for the app's user id.
Privacy Dashboard
See which apps used the camera, microphone, location or clipboard in the last 24 hours, from the platform's own permission log.
No telemetry
No analytics, no hidden network calls, no identifiers sent anywhere. Only System Update has internet access and it talks to one server over HTTPS.
Platform hardening
SELinux enforcing, always
Every build variant, no permissive domains, and CYRONIX adds no new domains of its own.
Kernel hardening 1.5.0
Yama ptrace restriction, restricted kernel logs, panic on oops, list-corruption detection, software PAN, branch-predictor hardening, SYN cookies. Symbol export, Magic SysRq and the memory-dump-on-crash mode are removed.
Locked-down runtime
Kernel pointers hidden, core dumps from privileged processes disabled, protected symlinks and hardlinks, no ICMP redirects, no source routing, unnecessary root helpers stopped on release builds.
System integrity
dm-verity with error correction on the system partition; no root binary, no Magisk, no set-uid helpers. Security Center flags any root binary it ever finds.
Minimal privilege
Every privileged permission held by a CYRONIX app is listed and justified in the public security document. None hold camera, microphone, location, contacts or SMS.
Release signing
Every release is signed with unique CYRONIX keys generated outside the source tree. Public test keys are never used, and Security Center checks the phone's update trust store for them.
Verified updates
| Transport | HTTPS only, TLS 1.2 and up, from a self-hosted server. Reachable from any internet connection through a public entry point; the certificate is verified against the server name on every path. |
|---|---|
| Package | SHA-256 from signed metadata, then the whole-package signature is checked against the CYRONIX release key on the phone before anything is installed, and again by the recovery. |
| Server | Serves nothing but the update query and the release packages. HSTS, no MIME sniffing, no referrer leakage, no framing; no client identifiers are logged. |
| Your recovery stays yours | "Keep my recovery" leaves an owner-installed CYRONIX Recovery OS in place across updates. |
Security Center
One screen shows the phone's real posture with a score that counts only what the build can verify: patch levels, SELinux, root, boot state, encryption, screen lock, USB debugging, unknown sources, accessibility services, device admins, VPN, and since 1.5.0 the update signing key, USB restricted mode, lock-screen privacy, developer options, kernel sysctls, Private DNS, Bluetooth and NFC state. "Export security report" writes a plain-text report to Downloads without touching the network.
What we say plainly
Unlocked bootloader
Running a custom OS on this device requires it, and the device has no Verified Boot 2.0. Anyone with physical access can flash images. Encryption, USB restricted mode, auto-reboot and erase-after-failed-unlocks are the defences against that.
Older kernel and firmware
Linux 3.18 and 2019 vendor firmware. Fixes are backported by hand and patch levels are never inflated.
No MAC randomisation
The Wi-Fi driver does not support it. The Security Center says so rather than hiding it.