Supported versions
Security fixes are provided for the latest stable Trit release. Pre-release and older versions may be asked to upgrade before a fix is evaluated.
Reporting a vulnerability
Email security@trit.wtf. Repository collaborators may alternatively use GitHub private vulnerability reporting. Do not disclose vulnerabilities in public issues, discussions, or pull requests before a fix is available.
Include the affected version, deployment mode, reproduction steps, expected impact, and any suggested mitigation. Remove credentials, private source code, prompt content, and database records that are not required to reproduce the issue.
Trust model
Trit launches coding agents and interactive shells as the Trit service user. A configured agent can access the service environment and approved project roots. Interactive terminals provide shell access as that user. Run Trit only on a trusted host, never as root, and expose it remotely only through a validated authentication mode.
The default installer binds local authentication to loopback. Cloudflare Access deployments must validate the Access JWT and configure an exact public origin. Raw identity headers are not considered authentication.