If you believe you have found a security vulnerability in Locus (the Oracle Generative AI Agentic Harness), please report it to us through coordinated disclosure.
Please do not report security vulnerabilities through public GitHub issues.
Instead, use GitHub private vulnerability reporting on this repository, or follow Oracle's security vulnerability reporting process (secalert_us@oracle.com), including:
- A description of the vulnerability
- Steps to reproduce the issue
- Any potential impact
- Any suggested fixes (if applicable)
We will acknowledge receipt of your vulnerability report and send you regular updates about our progress.
Security fixes land on the latest released minor of the current major.
Older minors are not backported — upgrade within the major instead, which
DEPRECATION.md guarantees is non-breaking.
| Version | Supported |
|---|---|
Latest 3.x minor |
✅ |
Earlier 3.x minors |
❌ — upgrade to the latest 3.x |
2.x (published as tulip-agents) |
❌ — retired; upgrade to locus-sdk 3.x |
< 2.0 |
❌ |
Pin a major, as in locus-sdk>=3,<4, and take the newest minor within it.
Minors ship often, so an enumerated list of supported minors would be stale
faster than it could be maintained; this table is written to stay correct
without edits.
When using the SDK in production:
-
API Keys: Never commit API keys or secrets to version control. Use environment variables or secret management systems.
-
Tool Execution: Be cautious when allowing agents to execute tools that interact with external systems. Implement proper sandboxing and validation.
-
Input Validation: Always validate and sanitize user inputs before passing them to agents.
-
Model Access: Use appropriate OCI IAM policies and scoped API keys to restrict access to OCI Generative AI and other model providers.
-
Checkpointing: When using persistent checkpointing backends (Oracle Database, OCI Object Storage, Redis, PostgreSQL, etc.), ensure proper authentication and encryption in transit — use wallets (mTLS) for Autonomous Database.