Ebb moves files on your machine, so please report safety problems privately.

Report: open a private advisory at Security → Report a vulnerability on this repository, or email the maintainer through their GitHub profile.

In scope: anything that lets a plan touch a protected path, restore files to the wrong place, make an AI client apply a plan on its own, or write outside an MCP client's own config file.

Design notes and past reviews: docs/ARCHITECTURE.md, docs/reviews.