Please do not open a public issue. Report privately through GitHub’s private vulnerability reporting with steps to reproduce and the affected version.
You can expect an acknowledgement within three business days and a fix or mitigation plan within 30 days for confirmed issues, faster for critical ones. We will credit you in the release notes unless you prefer otherwise.
The latest minor release receives security fixes.
In scope: the agentposture package, its dashboard, API, connectors, container image and GitHub
Action. For how AgentPosture protects the data it holds, and deployment hardening, see
docs/security.md.