stack-up runs the open TAIPANBOX agent-governance stack on your own machine, natively, building every plane from source and binding everything to loopback only, so its trust boundary is that machine and whatever it clones and compiles onto it.

Please report security issues privately, not in public issues or pull requests: open a GitHub private security advisory at https://github.com/TAIPANBOX/stack-up/security/advisories/new. Include the affected version or commit, a description and a minimal reproduction. We aim to acknowledge within a few days and to fix high-severity issues before any public disclosure, with coordinated disclosure within 90 days of the report. There is no bug-bounty programme; reporters are credited in the advisory unless they prefer otherwise.

Before this repository's 1.0, only main is supported: fixes land on main and are not backported. From its 1.0 tag, the newest minor gets every fix and the previous minor gets security-relevant fixes for 90 days after the newer one is tagged.

Every change passes the repository's gates before merge: shellcheck up.sh down.sh routines.sh, bash -n on all three, scripts/loopback-only.sh, scripts/gateway-cache-is-off.sh, scripts/cloud-key-is-per-run.sh, scripts/cloud-key-is-not-printed.sh, scripts/admin-keys-are-per-run.sh, scripts/postures-are-held.sh, scripts/keyryx-is-per-run.sh, scripts/record-is-signed-by-default.sh, scripts/record-key-is-pinned.sh, scripts/wardryx-fails-closed.sh, scripts/typed-mode.sh, scripts/run-budget-ceiling-is-set.sh, scripts/bus-files-match-sources.sh, scripts/chain-verify-routine.sh, scripts/manifest-is-true.sh, scripts/features-are-bound.sh, scripts/die-keeps-its-exit-status.sh, scripts/demo-issuer-is-unbound.sh, scripts/bus-is-operator-owned.sh and scripts/gates-have-teeth.sh.