Please report vulnerabilities privately through GitHub: on this repository's Security tab choose Report a vulnerability, or go straight to https://github.com/RealGeeks/geekcli/security/advisories/new. Do not open a public issue, pull request or discussion for a security problem.

Useful details: the geekcli version (geekcli --version), your operating system, the command involved, and what an attacker could do. Never include a real API key; revoke any key that may have been exposed under Admin → API keys on the site.

We will acknowledge the report, keep you updated while we work on a fix, and credit you in the advisory if you would like.

Security fixes go into the latest release. Update with the install command in the README or by downloading the newest release.

This repository covers the geekcli client and its install scripts. Problems with a Real Geeks website or the Content API itself can be reported the same way and will be passed to the right team.

Every release archive has a .sha256 checksum beside it and a signed build-provenance attestation. geekcli update verifies the attestation itself (Sigstore's trust root is built in) and refuses an archive that was not built by this repository's release workflow on main; the install scripts do the same through the GitHub CLI when it is installed and logged in, and otherwise print the command. To check an archive by hand:

gh attestation verify geekcli-<version>-<target>.tar.gz --repo RealGeeks/geekcli \
  --cert-identity https://github.com/RealGeeks/geekcli/.github/workflows/release.yml@refs/heads/main

GEEKCLI_SKIP_PROVENANCE=1 skips the attestation in both, for mirrors that cannot reach GitHub; the sha256 is still checked.

API keys are kept in ~/.config/geekcli/config.toml, readable only by you (mode 600 in a 700 directory, restored with a warning if found looser). They are not in the operating system's keychain; that is a possible future option. Anyone who can run code as your user can read the file, so revoke a key under Admin → API keys if the machine may be compromised.