Please do not report security vulnerabilities through public GitHub issues.
Email support@documentnode.io with SECURITY in the subject
line. Include as much of the following as you can:
- What the issue is and why you believe it is a security problem
- The TermTree version and your operating system
- Steps to reproduce, or a proof of concept
- What an attacker could achieve with it
You will get an acknowledgement that a human has read your report. We will keep you informed as we investigate, and we will tell you when a fix ships. If you would like credit in the release notes, say so and tell us how you would like to be named.
Please give us a reasonable opportunity to fix the issue before disclosing it publicly.
TermTree is in beta and ships as a single release line. Only the latest released version receives security fixes. Update from within the app, or download the current version at termtree.com/download.
In scope: the TermTree desktop application, its update mechanism, its optional cloud sync, and the install script served at https://termtree.com/install.sh.
Out of scope: the benchmark/ harness published in this repository. It is a local developer tool
you build and run yourself — it launches other applications on your own machine under your own
account, and writes only to its own disposable scratch directory. Report bugs in it as an issue,
not as a security report.
Out of scope: the security of programs you choose to run inside TermTree's terminals. Those are ordinary terminal sessions — Claude Code, Codex, shells, servers, and other CLIs run with your own credentials under their own security models, exactly as they would in any other terminal emulator.