| Version | Supported |
|---|---|
| 0.x (develop) | ✅ |
Use GitHub Private Vulnerability Reporting — this ensures the report is confidential and only visible to maintainers.
Include as much detail as possible:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)
- Agent harnesses execute tools with real-world side effects. Report approval-gate bypasses, storage replay corruption, and injection via tool arguments as security issues, not bugs.