We actively maintain and provide security updates for the latest release on the main branch.

If you discover a potential security vulnerability in secure-agent, please do not report it publicly via GitHub issues.

Instead, please report vulnerabilities responsibly by emailing security disclosures to:

📧 security@cavi.ai

To help us triage and investigate the issue efficiently, please include:

1. Description: A clear overview of the issue and potential security impact.
2. Reproduction Steps: Step-by-step instructions or proof-of-concept payload.
3. Environment: macOS version, Go version, agent harness (Claude Code, Cursor, Codex, etc.).
4. Impact Assessment: What data, credentials, or system resources could be exposed or modified.

• Redaction: Detected secret values are masked with [REDACTED] before inclusion in stored/displayed evidence and local model context. Detection has limits: an unregistered value that matches no pattern can be missed. See secret handling.
• Local access: The daemon's Unix socket is owner-scoped (0600) with peer authorization. An enabled loopback proxy also serves the console API behind a separate console token; some routes further refuse agent processes. See API authentication.
• External destinations: Fleet webhooks and OTLP export are opt-in and send selected telemetry to configured destinations. Local chat and advisor calls require loopback model endpoints. Routed agent requests still go to their original upstream destinations. Review configuration and the advisor threat model for the scope of each path.

• Acknowledgement: We will acknowledge receipt of your vulnerability report within 48 hours.
• Investigation: We will investigate and validate the issue within 5 business days.
• Remediation: Once verified, we will develop and release a fix as quickly as possible and publicly credit your responsible disclosure (unless you prefer anonymity).