Only the main branch receives security fixes.

Please report vulnerabilities privately through GitHub: the repository's Security tab → Report a vulnerability. Do not open a public issue.

Include what you found, how to reproduce it, and the impact you expect. We will acknowledge the report, keep you informed while we fix it, and credit you in the release notes if you wish.

Issues we especially want to hear about: one company's data or agents reaching another company, authentication bypass, API key or session leaks, and a local_trusted server that can be reached from outside loopback.