Security & release integrity
Evidence belongs beside the release.
Report vulnerabilities privately, see which release lines are supported, and verify the archive before it reaches your machine.
Version, platform, channel and packaged-file hashes are cryptographically bound.
Each native archive has a matching SPDX 2.3 software bill of materials.
GitHub records provenance and SBOM attestations against the archive digest.
Undisclosed vulnerabilities go directly into a private maintainer advisory.
Report
Keep undisclosed vulnerabilities private.
Use GitHub Private Vulnerability Reporting. Include the affected version and platform, impact, reproduction steps and any known exploitation. Remove credentials and unrelated personal or repository data.
Open a private report ↗Support
Security fixes follow the supported release line.
The current stable release is the production line. Dev builds are evaluation releases; reports are accepted, but a fix may require moving to a newer prerelease. Security updates are provided without an additional fee.
Read the support policy ↗Verify
Match the archive, RID and SBOM.
Windows, macOS and Linux releases each publish their own archive and SPDX document. Verify the archive digest with GitHub CLI; the installer then verifies the signed manifest and every extracted file.
gh attestation verify mt-win-x64.zip --repo tlbx-ai/tlbxBoundary
Your machine remains the runtime.
tlbx is self-hosted. Terminals, agents, credentials and repositories remain on the selected host. Use HTTPS and a private network path such as Tailscale instead of exposing the service directly to the public internet.
See the architecture →Process
Dependency and release checks fail closed.
Locked npm, NuGet and Gradle graphs are audited during release. Missing signatures, metadata mismatches, wrong platforms, unlisted files and hash mismatches stop installation or update.
Read the security policy ↗Regulatory status
No premature conformity claim.
tlbx is preparing the technical evidence and operating processes required by the EU Cyber Resilience Act. No current release claims CRA conformity, certification or CE status. A declaration and CE marking will appear only after the applicable conformity assessment has been completed.