Security & release integrity
Check downloads and control access.
Report vulnerabilities privately, see which release lines are supported, and verify the archive before it reaches your machine.
The installer checks a signed list of the version, platform and files it is installing.
Each download includes a software bill of materials (SBOM) listing its components in SPDX 2.3 format.
GitHub records which build produced each archive and its component list.
Undisclosed vulnerabilities go directly into a private maintainer advisory.
Report
Keep undisclosed vulnerabilities private.
Use GitHub Private Vulnerability Reporting. Include the affected version and platform, impact, reproduction steps and any known exploitation. Remove credentials and unrelated personal or repository data.
Open a private report ↗Support
Security fixes follow the supported release line.
The current stable release is the production line. Dev builds are evaluation releases; reports are accepted, but a fix may require moving to a newer prerelease. Security updates are provided without an additional fee.
Read the support policy ↗Verify
Verify the download for your platform.
Windows, macOS and Linux releases each publish their own archive and SPDX document. Verify the archive digest with GitHub CLI; the installer then verifies the signed manifest and every extracted file.
gh attestation verify mt-win-x64.zip --repo tlbx-ai/tlbxBoundary
Protect access to your machine.
tlbx is self-hosted. Terminals, agents, credentials and repositories remain on the selected host. Use HTTPS and a private network path such as Tailscale instead of exposing the service directly to the public internet.
See the architecture →Process
Checks stop invalid installs and updates.
Locked npm, NuGet and Gradle graphs are audited during release. Missing signatures, metadata mismatches, wrong platforms, unlisted files and hash mismatches stop installation or update.
Read the security policy ↗Regulatory status
EU regulatory status
tlbx is preparing the technical evidence and operating processes required by the EU Cyber Resilience Act. No current release claims CRA conformity, certification or CE status. A declaration and CE marking will appear only after the applicable conformity assessment has been completed.