Please do not open a public issue for security vulnerabilities.

• Privately report via GitHub: Security → Report a vulnerability on https://github.com/LuckTerence/trustline/security/advisories (preferred — creates a private advisory we can coordinate a fix and disclosure on).
• Or email the maintainer: cys2193736202@163.com

We aim to acknowledge reports within 72 hours and ship a fix in the next patch/minor release.

Trustline is not a sandbox and not a verdict engine. Read this before you rely on it:

1. Static heuristics only. scan and the PreToolUse write-check match text signals (15 rules in v0.1). A finding means "review this" — not "this is malicious". Evasion and false positives are both possible.
2. Pre-baseline guardrail & What YOU approve. init automatically runs an initial security scan for high-severity tampering signals. If malicious patterns are detected, init aborts and refuses to baseline them (unless explicitly overridden with --force). Once approved, init snapshots the cryptographic baseline.
3. Hooks are defense-in-depth, not a guarantee. The model's own safety training is the first line; Trustline's hooks are the second. PreToolUse inspects the content the agent is about to write; it does not sandbox the agent's subsequent actions. A malicious rules file already on disk is surfaced by SessionStart/scan, but the agent may still have read it.
4. InstructionsLoaded is best-effort. The event is not emitted in every Claude Code version or in headless mode.
5. State is local. Baseline hashes, optional content snapshots, tampered backups and the audit log live under ~/.config/trustline/. Protect that directory like you protect your SSH keys — a content snapshot is a copy of your rules files.

Does:

• Detect drift between your agent-config files and a baseline you approved.
• Restore them (git HEAD or snapshot), keeping the tampered copy for forensics.
• Block high-severity tamper-like content from being written by the agent into a managed file (via Claude Code PreToolUse), and warn on drift at SessionStart.
• Export findings as SARIF for CI / DefectDojo and append every hook decision to a local audit log.

Does not:

• Execute or sandbox agent commands. If a poisoned rule has already influenced a session, Trustline cannot undo what the agent did — restore the file and treat the machine/session as potentially compromised.
• Guarantee detection of every poisoning technique. Static rules can be evaded by obfuscation that the heuristics do not cover.

We defend against the repository / MCP / skill-pack supply chain: rules files (AGENTS.md, CLAUDE.md, .claude/, .cursorrules, .mcp.json, .codex/, copilot instructions) that arrive with code you did not author being used to steer your coding agent toward exfiltration, privilege tampering, persistence, or concealment.

We do not defend against a fully compromised machine or an attacker who can modify ~/.config/trustline/ (they can simply re-run init). Treat Trustline as a tripwire + recovery tool for the supply-chain case, not as an endpoint security product.

• Hook commands never embed secrets; they read stdin JSON and write to the audit log only.
• rollback copies tampered content to the state dir outside the working tree so it never re-enters the baseline or git history.
• Findings contain only static text matches — no network calls, no code execution, no telemetry.