About NAILS

What NAILS is for

NAILS does one narrow job. It keeps a hidden session off the disk of an ordinary-looking Linux system, against someone who examines that disk offline after the fact. In that sense NAILS is anti-forensics software: it narrows what an offline examination of the decoy can find. The threat model sets out exactly what that covers and where it stops.

NAILS encrypts nothing itself. The hidden volume and its deniability come from the storage backend you choose, for example a VeraCrypt hidden volume. For more, read the answers to common questions and how NAILS compares with other tools.

History

Development began in 2025. Releases 0.1 and 0.2 ran only on NixOS. They overlaid directories of the running decoy, such as /etc, /home and /var, and read a YAML configuration. The 0.3 line replaces that design with one overlay over the whole decoy root, entered and left with a soft-reboot, and adds Debian and Ubuntu decoys. The news page has the release announcements.

Status

• NAILS is alpha software. Interfaces and workflows can still change between releases.
• Use it only after testing your exact hardware, storage backend, activation path and recovery procedure.
• Its security claims are bounded by the documented threat model and by the checks you run on your own setup.
• It has one maintainer, so support and security response are best effort.

How it is built and tested

• NAILS is written in Rust. Releases are one static binary for x86-64 Linux, built with Nix.
• How it works describes the design, and the architecture overview in the repository explains why the session takes the whole root and what that costs.
• Automated tests run whole sessions in NixOS, Debian 13 and Ubuntu 24.04 virtual machines. A release run boots every NixOS VM test on the tagged commit, apart from the informational performance tests. The Debian and Ubuntu tests run nightly.
• The parsers that read input NAILS does not control, such as mount tables, fstab and crypttab, systemd configuration and disk layouts, are fuzzed with ClusterFuzzLite every day and on pull requests that change fuzzed code.
• CodeQL scans the Rust code, the Python tooling and the workflows for vulnerable patterns. A pull request into the main branch merges only with its results, and not with a new high or critical security alert on a line it changes.
• OpenSSF Scorecard, an automated check of repository practices such as pinned dependencies, token permissions and branch protection, runs on every push to the main branch and weekly. It reads the repository through the GitHub API and runs none of its code. Its latest Scorecard result is public.
• A release run builds the binary from source, builds it again on a fresh runner and compares the two byte for byte. Once every check has passed, it signs attestations of the build provenance and the software bill of materials of the binary and the archive. From v0.3.0-rc.3 on, each release carries them as Sigstore bundles, which cosign checks without a GitHub account. The download page shows how to check a release.

The repository's CI and release automation page describes each workflow, and GitHub Actions shows their runs.

None of these checks says that the code is free of flaws.

Developed with AI assistance

In the project's own words: NAILS has been developed with AI-assisted tooling for drafting code, tests, and documentation. All security-relevant design decisions, code changes, and published documentation remain the responsibility of the maintainer and are intended to be reviewed and validated before release.

Acknowledgements

With thanks to Tails, NixOS, the Tor Project and nix-community/impermanence.

This website

• nails.run is a static site. It sets no cookies, runs no analytics and loads nothing from other servers.
• GitHub Pages serves it. Like any web host, GitHub can see your IP address and the pages you request.
• Links to other sites do not tell them that you came from nails.run.
• The theme you pick is kept in your browser's local storage, and the docs keep the sidebar's state in session storage. Neither is sent anywhere.
• Reading these pages in the decoy system's browser leaves them in its history, and following the news feed in a feed reader there leaves the subscription behind. Do both somewhere else when that matters.

Contact and license

• Bugs and feature requests go to GitHub issues. Issues are public and link your GitHub account to NAILS. Consider a throwaway account, and never post real paths, host names, or the output of nails status or nails verify.
• Security issues are reported privately, as described on the security page.
• NAILS is maintained by WitteShadovv and licensed under GPL-3.0-or-later.
• It is provided for educational and security research purposes, with no warranty. It is not a guarantee of deniability or forensic invisibility in any specific threat environment.