Security fixes are currently evaluated for the latest public 0.2.x release. Older versions may not receive backports.

Do not publish credentials, private repository content, exploit details, or sensitive run artifacts in a public issue.

Use GitHub's private security-advisory workflow when it is available for this repository. Otherwise, contact the repository owner through the private contact methods shown on the owner's GitHub profile and provide only the minimum information needed to establish a secure reporting channel.

Include:

• affected version;
• affected module or artifact;
• reproduction steps using non-sensitive test data;
• impact and trust boundary crossed;
• whether the issue changes target repository files, executes commands, exposes excluded content, bypasses endpoint restrictions, or invalidates acceptance/receipt guarantees.

Repository Agent Team is designed to reduce, not eliminate, repository-analysis risk.

Instructions inside scanned files cannot grant permissions or change runtime mode. The tool does not execute target repository code.

Known secret-bearing filenames are skipped before content reads. This policy is name-based and cannot identify every possible secret location. Do not point the tool at data you are not authorized to process.

Pattern-based secret redaction can miss unusual formats and can produce false positives. It is not a substitute for repository secret scanning or access control.

By default, only localhost and explicit loopback/private/link-local IPs are accepted. Setting REPO_AGENT_ALLOW_REMOTE=true can send repository evidence outside the local/private boundary. Review provider retention, logging, jurisdiction, and access policies before enabling it.

Protect the external run directory according to the sensitivity of the inspected repository. Reports, indexes, prompts, and batch outputs may disclose filenames, architecture, code excerpts, findings, or model responses.

Acceptance receipts detect byte changes to the four core artifacts through SHA-256. They do not authenticate the creator, model, host, repository state, or receipt issuer.

Version 0.2.6 does not provide:

• sandboxed execution of target repository commands;
• write-capable remediation;
• signed provenance or identity attestation;
• comprehensive secret discovery;
• malicious-model isolation;
• protection from a compromised local host or model endpoint.