With this weak-ass disclaimer:
> Tailscale (the company) treats the security of the Tailscale core very seriously, and tailcat is built from those same production components: WireGuard, magicsock, DERP, and gVisor's netstack.
> The tailcat wrapper around them, however, is an early experimental tool. It has a lot of powerful features, but it was originally designed for use with oneself: the same person running both ends. Its threat model hasn't historically included malicious adversaries, such as tailcat use between two different parties, one of whom might be trying to attack you.
> We recognize that people will inevitably and increasingly use tailcat between mutually untrusting parties, and we do want to harden it for those use cases over time. Until then, be thoughtful about accepting tailcat addresses from, or serving powerful things (shells, writable directories, exit nodes) to, people you don't trust. Security reports that help us get there are very welcome.
https://github.com/tailscale/tailcat/security
:rainbowCrow:
npub1s6…8n008
2026-09-04 20:46:18 UTC
in reply to nevent1q…ksz3
Author Public Key
npub1s6eewzr2zvz3ppsa6k8j2hadamsug7q4rp068wmz3grtf440xxkqr8n008Published at
2026-09-04 20:46:18 UTCEvent JSON
{
"id": "dd35cf2b4b7a9456e42a357f76b97a6dc059730c92cd501a3632d89ce3cc5dc3",
"pubkey": "86b397086a130510861dd58f255fadeee1c47815185fa3bb628a06b4d6af31ac",
"created_at": 1788554778,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/@cR0w/117214725943615690",
"web"
],
[
"p",
"970923b9ed315d1b3bc6de2baa8af1f0e8b7c635a7bfb09949ed9d36b9f30c6a"
],
[
"p",
"0ddebc86c6a4795b5b9079c6034f5790262765f70c72e96bc3cf722148aa3599"
],
[
"p",
"86b397086a130510861dd58f255fadeee1c47815185fa3bb628a06b4d6af31ac"
],
[
"p",
"663bad2dad8d2d1de0c04748de4813f82064ce0c07f6384d210fa0f0967d3d11"
],
[
"e",
"68f09f49a24d3ad7e893b2565c8defdbd08bfeb5e1e62ad85ff95fdf620ac925",
"",
"reply",
"970923b9ed315d1b3bc6de2baa8af1f0e8b7c635a7bfb09949ed9d36b9f30c6a"
],
[
"e",
"3781631b1728e291839b20989387aace5367eab2ba4f1e7762c9713469964820",
"",
"root",
"ebe10d8710e7d0334ec76033eebdb3774acd985256ac7013038282d5da05ab87"
],
[
"p",
"ebe10d8710e7d0334ec76033eebdb3774acd985256ac7013038282d5da05ab87"
],
[
"proxy",
"https://infosec.exchange/users/cR0w/statuses/117214725943615690",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/cR0w/statuses/117214725943615690",
"pink.momostr"
],
[
"-"
]
],
"content": "With this weak-ass disclaimer:\n\n\u003e Tailscale (the company) treats the security of the Tailscale core very seriously, and tailcat is built from those same production components: WireGuard, magicsock, DERP, and gVisor's netstack.\n\n\u003e The tailcat wrapper around them, however, is an early experimental tool. It has a lot of powerful features, but it was originally designed for use with oneself: the same person running both ends. Its threat model hasn't historically included malicious adversaries, such as tailcat use between two different parties, one of whom might be trying to attack you.\n\n\u003e We recognize that people will inevitably and increasingly use tailcat between mutually untrusting parties, and we do want to harden it for those use cases over time. Until then, be thoughtful about accepting tailcat addresses from, or serving powerful things (shells, writable directories, exit nodes) to, people you don't trust. Security reports that help us get there are very welcome.\n\nhttps://github.com/tailscale/tailcat/security",
"sig": "3d7d5a6a4cb1a836245810c3ab44b6006dc819a9f5e4be69239fe1ce0760d9eba2a8c2308461e4b4a0caabe4ef33552d5224dedae57cfa6066fdfa8b8c5d236b"
}