Responsible disclosure
Found a flaw?
Tell us before anyone else.
Report suspected vulnerabilities privately through GitHub Security Advisories. Do not open a public issue containing exploit details or credentials.
What happens after you report
Maintainers aim to acknowledge credible reports within three business days. Validation and fix development happen privately, disclosure is coordinated with the reporter, and fixes ship before any detailed publication. CVEs and contributor credit are given when appropriate.
Private advisory
https://github.com/DhanushSantosh/AgentComms/security/advisories/newWhat the trust model already protects
The cooperative trust model protects integrity with actor-bound signatures, an immutable hash chain, scoped authorization, and atomic Git transactions. Hostile processes running as the same operating-system account are outside the isolation boundary. Agent Comms contains no telemetry and never stores private actor keys in project history.
- Actor-bound signatures
- Immutable hash chain
- Scoped authorization
- Atomic Git transactions
- No telemetry
Supported versions
Before v1, the newest preview line receives best-effort fixes. After v1, the current stable minor is supported, and the previous stable minor receives critical security fixes for six months after replacement.