diff --git a/sumdb/tlog/note_test.go b/sumdb/tlog/note_test.go
index a32d6d2..3373a0c 100644
--- a/sumdb/tlog/note_test.go
+++ b/sumdb/tlog/note_test.go
@@ -115,3 +115,19 @@ func TestParseRecord(t *testing.T) {
 		}
 	}
 }
+
+// FuzzParseTree tests that ParseTree never crashes
+func FuzzParseTree(f *testing.F) {
+	f.Add([]byte("go.sum database tree\n123456789012\nTszzRgjTG6xce+z2AG31kAXYKBgQVtCSCE40HmuwBb0=\n"))
+	f.Fuzz(func(t *testing.T, text []byte) {
+		ParseTree(text)
+	})
+}
+
+// FuzzParseRecord tests that ParseRecord never crashes
+func FuzzParseRecord(f *testing.F) {
+	f.Add([]byte("12345\nhello\n\n"))
+	f.Fuzz(func(t *testing.T, msg []byte) {
+		ParseRecord(msg)
+	})
+}
diff --git a/sumdb/tlog/tile_test.go b/sumdb/tlog/tile_test.go
new file mode 100644
index 0000000..e451a63
--- /dev/null
+++ b/sumdb/tlog/tile_test.go
@@ -0,0 +1,24 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package tlog
+
+import (
+	"testing"
+)
+
+// FuzzParseTilePath tests that ParseTilePath never crashes
+func FuzzParseTilePath(f *testing.F) {
+	f.Add("tile/4/0/001")
+	f.Add("tile/4/0/001.p/5")
+	f.Add("tile/3/5/x123/x456/078")
+	f.Add("tile/3/5/x123/x456/078.p/2")
+	f.Add("tile/1/0/x003/x057/500")
+	f.Add("tile/3/5/123/456/078")
+	f.Add("tile/3/-1/123/456/078")
+	f.Add("tile/1/data/x003/x057/500")
+	f.Fuzz(func(t *testing.T, path string) {
+		ParseTilePath(path)
+	})
+}
diff --git a/zip/zip.go b/zip/zip.go
index c5eca4b..7b48a2a 100644
--- a/zip/zip.go
+++ b/zip/zip.go
@@ -663,7 +663,7 @@ func filesInGitRepo(dir, rev, subdir string) ([]File, error) {
 		if n == "" {
 			continue
 		}
-		n = strings.TrimPrefix(n, string(filepath.Separator))
+		n = strings.TrimPrefix(n, "/")
 
 		fs = append(fs, zipFile{
 			name: n,
diff --git a/zip/zip_test.go b/zip/zip_test.go
index 84a3ecd..173cc65 100644
--- a/zip/zip_test.go
+++ b/zip/zip_test.go
@@ -1532,7 +1532,7 @@ c/`)))
 			}
 			wantMap := map[string]bool{}
 			for _, f := range tc.wantFiles {
-				p := filepath.Join("example.com", "foo", "bar@v0.0.1", f)
+				p := path.Join("example.com", "foo", "bar@v0.0.1", f)
 				wantMap[p] = true
 			}