Only the latest minor release line receives security fixes.
| Version | Supported |
|---|---|
| latest | yes |
| older | no |
Please do not open public GitHub issues for security problems.
Report privately via GitHub Security Advisories: https://github.com/valllabh/hush/security/advisories/new
Or email: vallabh.joshi@gmail.com with subject prefixed [hush-security].
Include:
- a description of the issue and its impact
- steps to reproduce or a proof of concept
- affected hush version (
hush --version) - your contact info for follow up
You should receive an acknowledgement within 72 hours. A fix plan with a disclosure timeline will follow within 7 days.
Hush is a local scanner. It does not make network calls, does not send samples anywhere, and does not require credentials. The primary risks we take seriously:
- arbitrary file read through path traversal in scan targets
- denial of service through pathological inputs (extreme file sizes, deeply nested archives, regex catastrophic backtracking)
- supply chain compromise of the embedded model or dependencies
Hush is not a sandbox. Do not scan hostile binaries or rely on hush to contain malicious inputs. Run hush as a non-privileged user on untrusted paths.
Every archive and the SHA256SUMS file is signed with cosign keyless, using the GitHub Actions OIDC identity of the release workflow. No long lived key exists.
VERSION=0.1.0
ARCH=linux_amd64
curl -sSLO https://github.com/valllabh/hush/releases/download/v${VERSION}/hush_${VERSION}_${ARCH}.tar.gz
curl -sSLO https://github.com/valllabh/hush/releases/download/v${VERSION}/hush_${VERSION}_${ARCH}.tar.gz.sig
curl -sSLO https://github.com/valllabh/hush/releases/download/v${VERSION}/hush_${VERSION}_${ARCH}.tar.gz.pem
cosign verify-blob \
--certificate hush_${VERSION}_${ARCH}.tar.gz.pem \
--signature hush_${VERSION}_${ARCH}.tar.gz.sig \
--certificate-identity-regexp "https://github.com/valllabh/hush/.github/workflows/release.yml@.*" \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
hush_${VERSION}_${ARCH}.tar.gz
A passing verification proves the archive was produced by hush's own release workflow at the tagged commit.