Do not open a public issue for a vulnerability that could expose a ttyx host or its files. Report it privately through GitHub's security advisory form.

Include the ttyx and Bun versions, host operating system, configuration flags, and a minimal reproduction. Do not include live credentials, session cookies, or private files.

ttyx grants terminal access to the account that runs it. It also maps absolute directory paths to terminal routes and enables authenticated drag-and-drop uploads by default.

• Keep the default loopback bind unless a reverse proxy or private network controls access.
• Use TLS before accepting credentials over a network.
• Use --no-auth only on a trusted machine or network.
• Configure trusted proxy headers only when the proxy removes client-supplied copies of that header.
• Use --no-upload if browser uploads are not required.
• Run ttyx as an account with the minimum filesystem access needed for the shared command.

See the README for authentication, TLS, origin checking, and upload options.