Please do not file a public GitHub issue for security vulnerabilities.

Email connect@travsr.com with:

• A description of the vulnerability
• Steps to reproduce
• Potential impact
• Any suggested mitigations (optional)

You will receive an acknowledgement within 48 hours and a timeline for the fix within 7 days.

We follow a 90-day responsible disclosure policy:

1. You report the vulnerability privately.
2. We confirm receipt within 48 hours.
3. We investigate and develop a fix (target: ≤ 30 days for critical issues).
4. We coordinate a release date with you.
5. We publish a security advisory after the fix is released.
6. At day 90, you may disclose publicly regardless of fix status.

• cargo-deny check advisories licenses bans runs on every PR via CI
• Denies packages with known CVEs (vulnerability = "deny" in deny.toml)
• Denies copyleft licenses (GPL-2.0, GPL-3.0, AGPL-3.0, LGPL-2.0, LGPL-2.1)
• See deny.toml at the repository root for the full policy

• OSV Scanner runs nightly against Cargo.lock and packages/travsr-lsif-ts/package-lock.json (.github/workflows/osv-scan.yml)

• npm audit --audit-level=high runs on every PR for packages/travsr-lsif-ts

• travsr CLI binary and all crates in this workspace
• The npm wrapper (packages/travsr-npm)
• The git hook installed by travsr init

• Vulnerabilities in user repositories indexed by Travsr
• Issues in third-party dependencies (report those upstream)

Every release tarball is signed using cosign keyless signing via the Sigstore public-good transparency log. The signer identity is the GitHub Actions OIDC token issued for this repository's release.yml workflow.

# Install cosign: https://docs.sigstore.dev/cosign/system_config/installation/
VERSION=0.3.0
TARGET=x86_64-unknown-linux-gnu

# Download tarball and bundle from the GitHub release
curl -LO "https://github.com/Travsr-com/travsr/releases/download/v${VERSION}/travsr-v${VERSION}-${TARGET}.tar.gz"
curl -LO "https://github.com/Travsr-com/travsr/releases/download/v${VERSION}/travsr-v${VERSION}-${TARGET}.tar.gz.bundle"

# Verify
cosign verify-blob \
  --bundle "travsr-v${VERSION}-${TARGET}.tar.gz.bundle" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --certificate-identity-regexp "https://github.com/Travsr-com/travsr/.github/workflows/release.yml" \
  "travsr-v${VERSION}-${TARGET}.tar.gz"

Each release also carries a SLSA v1.0 build provenance attestation attached to the GitHub release via actions/attest-build-provenance. Verify with:

gh attestation verify "travsr-v${VERSION}-${TARGET}.tar.gz" \
  --repo Travsr-com/travsr

The travsr npm package automatically verifies the cosign signature during npm install if cosign is installed on the host. If cosign is not present, installation falls back to SHA256 verification only with a warning.