AgentStack is a security tool: it trust-gates, firewalls, and audits what AI agent CLIs are allowed to do on a machine. Vulnerability reports get an acknowledgment within 7 days.
Only the latest release receives security fixes. There are no maintained older branches.
Please report vulnerabilities privately — do not open a public issue.
Use GitHub private vulnerability reporting
on Tarekkharsa/agentstack. It is the only private channel, and it keeps the
report, the fix, and the advisory in one place.
Include what you can: affected version, reproduction steps, and impact (e.g. which trust, policy, secret, or sandbox guarantee is bypassed).
This is a single-maintainer project, so fix timelines depend on severity and complexity; you'll be kept informed of progress.
The current threat model and its known limits are documented, not implied:
- Security review (2026-07-11) — the most recent full review, including what was found and fixed.
- Enforcement matrix — what each guarantee actually enforces per CLI and per mode, including where enforcement is advisory.
Reports that show a gap between what those documents claim and what the code does are especially valuable.