nettune

The client wrapper automatically downloads and executes a Go binary from GitHub releases. This binary is verified by SHA256 checksums, which mitigates supply chain risk. API keys are passed via command-line arguments, making them visible in shell history, which is a security risk if not properly managed. The Go server component requires root/sudo privileges to modify system network settings. Communication between the client and the server uses HTTP with Bearer token authentication, but lacks built-in TLS. This means traffic is unencrypted by default, and a reverse proxy (e.g., Nginx with TLS) is highly recommended for production deployments to encrypt communications. There is no evident use of 'eval' or obfuscation, and file system operations appear confined to expected cache and state directories.