Report suspected vulnerabilities privately through GitHub Security Advisories, not a public issue. This channel is private between the reporter and the maintainer, so nothing is disclosed publicly until a fix is available and disclosure is coordinated.

Include what's needed to reproduce: the affected version or commit, the command run, the plugin or linter involved if relevant, and the expected versus actual behavior. There's no formal response-time SLA yet — rtunk has a single maintainer — but reports are triaged as they arrive.

Do not report vulnerabilities through public GitHub issues, discussions, or pull requests.

rtunk is pre-v1.0. Tagged releases exist (v0.13.0 to v0.14.0 at the time of writing, see the Releases page), and --version reports the release tag for a release archive and dev for a local go build. Fixes land on main; no release branch exists. No support or backport policy is defined for tagged releases yet.

Every release is built by the Release workflow (Actions, Release) on GitHub Actions, never on a maintainer's machine: it tags the commit, builds the archives with GoReleaser and publishes them on the Releases page. Each one ships, next to the archives:

• checksums.txt and checksums.txt.sigstore.json: the SHA256 of every archive, signed keyless with cosign (Sigstore). The signature is bound to the workflow's identity, not to a long-lived key that could leak.
• *.sbom.json: the SBOM of each archive, generated by syft.
• A SLSA build provenance attestation per archive, stored on GitHub.

# 1. The checksums were signed by a Release workflow, for this repository
cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github\.com/(axnic/rtunk/\.github/workflows/workflow_dispatch\.release\.yaml|axnic/\.github/\.github/workflows/go\.publish\.yaml)@refs/heads/main$' \
  --certificate-github-workflow-repository axnic/rtunk

# 2. The archive matches the signed checksums
sha256sum --ignore-missing -c checksums.txt        # shasum -a 256 -c on macOS

# 3. The archive was built by that workflow from this repository
#    Releases signed by the central workflow:
gh attestation verify rtunk-<tag>-<os>-<arch>.tar.gz -R axnic/rtunk \
  --signer-workflow axnic/.github/.github/workflows/go.publish.yaml
#    Releases signed by rtunk's own workflow (no --signer-workflow):
gh attestation verify rtunk-<tag>-<os>-<arch>.tar.gz -R axnic/rtunk

Two signing identities exist, because the release job moved to the central, reusable workflow go.publish.yaml of axnic/.github: releases cut before the move were signed by this repository's own workflow_dispatch.release.yaml, later ones by the central workflow, which then is the certificate identity. The regexp above accepts exactly these two, and --certificate-github-workflow-repository pins the repository in both cases. In step 3, use the command matching the release (the second one fails on a release signed centrally, and the first on an older one).

A release that fails any of these steps must not be used; report it as described above.

Signing starts with v0.14.0. v0.13.0 to v0.13.2 predate it: they ship checksums.txt and the archives only, so only step 2, against an unsigned checksums.txt, applies to them.

rtunk downloads and executes third-party binaries (linters and tools) declared by trunk plugin downloads: recipes. Every download is fetched over HTTPS only (plain http, including on redirect, is rejected) and streamed through a SHA256 hasher before being moved into the content-addressed cache. However, trunk plugin recipes carry no upstream checksum to verify against, so the trust model is trust-on-first-use (TOFU): the first download of a given artifact is accepted as-is, and a source compromised at that exact moment is not detected.

This is a known, documented limitation — not a vulnerability to report. See AGENTS.md ("Checksum-verified downloads") for the current design and its rationale. The planned hardening is rtunk.lock (pinned, verifiable checksums per artifact), tracked on the project roadmap and not yet implemented.