This policy covers all AgiMate repositories that do not carry a policy of their own.
Please do not open a public issue, pull request or discussion for a security problem.
Report it privately through GitHub private vulnerability reporting: open the Security tab of the affected repository and choose Report a vulnerability. The report, the discussion and the fix all stay in one place, and stay private until we publish.
You can also email agimate@mail.ru, for example when GitHub is not convenient or when the report concerns the organisation rather than one repository.
A useful report contains the affected repository and version or commit, what an attacker can achieve, and the steps to reproduce it. Proof-of-concept code is welcome. If you are not sure whether what you found is a real problem, send it anyway — deciding that is our job, not yours.
AgiMate is a small team, and we would rather state a timeline we can keep than an impressive one we cannot.
| Stage | Target |
|---|---|
| We acknowledge your report | within 3 business days |
| We confirm the issue and tell you our assessment | within 10 business days |
| Fix released, for a confirmed issue | depends on severity; we keep you updated |
| Public disclosure | after a fix ships, or 90 days after your report, whichever is first |
We will credit you by the name or handle you choose when we publish, unless you prefer to stay anonymous.
We will not pursue or support legal action against anyone who reports a vulnerability in good faith under this policy — that is, who makes a genuine effort to avoid privacy violations, data destruction and service degradation, works only against their own accounts and their own installations, and gives us reasonable time to fix the issue before telling anyone else.
AgiMate is self-hosted software: the right way to test it is on an installation you control. Testing against someone else's instance, or against our hosted service, is not covered by this policy.
There is no paid bug bounty at this time.
The project is before 1.0. Security fixes go into the latest release on the default branch; earlier versions are not patched. If you run AgiMate in production, track releases.