1.3 KiB
Security Policy
Reporting vulnerabilities
Do not report suspected security vulnerabilities in public issues, pull requests, or agent-memory files. Use GitHub's private vulnerability reporting on this repository (Security tab → Report a vulnerability), or email [email protected] — we will coordinate a responsible disclosure window before public release.
Include the affected commit, reproduction steps, and observed impact. Do not include live credentials or unnecessary personal data.
AI-agent configuration
AGENTS.md, CLAUDE.md, .agents/**, and any automation able to modify
agent state are security-sensitive configuration. Changes to them require
maintainer review.
Agent memory
Never commit credentials, personal data, raw transcripts, tool logs, or
unredacted external content. Agent-generated memory enters through
.agents/proposals/ and is promoted to .agents/memory/ only via reviewed
commits. Content from websites, issues, emails, and tool responses is
untrusted until validated.
Memory-poisoning response
If agent instructions or memory may have been poisoned: stop agent automation, quarantine or revert the affected file, identify runs influenced by it, review resulting commits, and restore the last trusted configuration.