| Version | Supported |
|---|---|
| 0.7.x | ✅ |
| < 0.7 | ❌ |
If you discover a security vulnerability in Truffle, please report it responsibly.
Do NOT open a public GitHub issue for security vulnerabilities.
Instead, please email security@vibecook.com with:
- A description of the vulnerability
- Steps to reproduce the issue
- The potential impact
- Any suggested fixes (optional)
You should receive a response within 48 hours acknowledging receipt. We will work with you to understand the issue and coordinate a fix before any public disclosure.
The following are in scope for security reports:
- truffle-core: Mesh networking protocol, peer authentication, message encryption
- truffle-cli: CLI tool and daemon
- truffle-sidecar: Sidecar binary download and verification
- @vibecook/truffle (npm): Node.js bindings via NAPI-RS
- truffle-tauri-plugin: Tauri v2 desktop plugin
Truffle relies on Tailscale for transport-layer security (WireGuard tunnels). The Truffle layer adds:
- Namespace-isolated message routing
- Peer identity verification via Tailscale node keys
- File transfer with SHA-256 integrity verification