tunr is an open-source project. This means both great things (community contributions!) and great responsibility (security!).

Please do NOT publicly disclose security vulnerabilities via GitHub Issues.

Doing so could put other users at risk. Instead:

1. Go to the "Security" tab of this repository
2. Click the "Report a vulnerability" button
3. Fill in the details and submit

For encrypted communication:

• Email: security@tunr.sh
• PGP: (Coming soon — to be added in Phase 0)

We accept reports on the following topics:

• Auth bypass — circumventing token validation
• SSRF — gaining internal network access (especially via tunr share)
• Path traversal — unauthorized file system access
• Injection — OS command injection, log injection
• Information disclosure — token/secret leakage
• Tunnel hijacking — taking over another user's tunnel
• DoS — taking down the service with a single payload

You can open a regular issue for these, but they do not qualify as security advisories:

• Self-XSS (hacking your own browser yourself)
• Rate limiting (unless beyond reasonable thresholds)
• Missing security headers (open as an enhancement request)
• Social engineering
• Physical attacks

We follow these guidelines in this project:

1. Secret management: Tokens are never written to logs; secrets are never stored in plaintext in config files
2. Input validation: Every CLI argument is validated
3. Least privilege: No more permissions are requested than necessary
4. Dependency audit: govulncheck is mandatory in CI
5. TLS verification: PRs containing InsecureSkipVerify: true are rejected
6. crypto/rand: math/rand is never used where cryptographic security is required

dependabot.yml is enabled for dependency security updates. Patches for critical CVEs are released within 48 hours.

We are grateful to those who report security vulnerabilities. Your name will be listed here 🏆

(Empty for now — maybe you'll be the first?)

This policy is effective as of [Phase 0]. It will be updated as the project evolves.