Wrapper provides access to live terminal sessions, so vulnerabilities must be reported privately before public disclosure.
Do not open a public issue or pull request for a suspected security problem. Use the hosted security-reporting instructions, email can@wrapper.sh, or submit a private GitHub security advisory while signed in to GitHub.
Include:
- affected version and platform
- impact and attack prerequisites
- minimal reproduction steps using test data
- logs with tokens, share codes, paths, and terminal content removed
- a safe proof of concept, if available
Do not access another user's terminal, retain terminal data, or disrupt production while investigating. We will acknowledge valid reports as soon as practical and coordinate disclosure after affected users are protected.
Suspected credential exposure, unauthorized relay access, or production-data
loss is a security incident even when no software vulnerability is confirmed.
Report it through the private channels above. Operators follow the incident,
backup/restore, and secret-rotation procedures in
OPERATIONS.md; production backups and secret values must
never be attached to a public GitHub issue.
GHSA-jmr9-qjv8-65gv and GHSA-7pqw-9j4j-h8q3 have no fixed upstream
extract-zip release. Wrapper only receives them through Mint's development-time
Puppeteer toolchain and applies
patches/extract-zip@2.0.1.patch to reject
symlink targets outside the extraction root. CI regression-tests that patch
before allowing those advisory-specific audit exceptions.
Mint still pulls adm-zip through its development toolchain. Wrapper overrides
it to 0.6.1, which is the patched release for GHSA-7q85-xj36-vmfc /
GHSA-vwc7-r8mq-g2x9. Remove the override when Mint no longer resolves the
package.
- A session is local and owner-only until the host explicitly shares it.
- Unshared hosts do not contact Convex. Session metadata is written only after share.
- Non-owner relay viewers need the session id and share code.
- Every accepted viewer can read and control the shared shell.
- P2P traffic is encrypted between peers and exposes peer IP addresses.
- Relay fallback is encrypted in transit, but the relay processes terminal traffic after TLS termination.
- Processes running as the same operating-system user, and root/administrator, are inside the local trust boundary.
See the Privacy Policy for the complete data flow.