Skip to content

Security: t2a-protocol/T2A

Security

SECURITY.md

Security Policy

Reporting Security Issues

Please report security issues privately instead of opening a public issue.

Before broad public release, GitHub Private Vulnerability Reporting should be enabled for this repository. Once enabled, use the repository's GitHub Security tab to privately report vulnerabilities.

Include:

  • A description of the issue.
  • Steps to reproduce it.
  • Potential impact.
  • Any suggested fix.

T2A Trust Boundary

T2A core validates the protocol envelope. The issuing tool validates domain-specific semantics.

T2A core checks task shape, declared files, output schema conformance, validation result shape, permissions, lifecycle fields, and checksums. It must not hardcode product-specific or domain-specific validators.

Intended Behavior

A T2A Capsule may ask a host agent to perform reasoning and write structured output. That is expected behavior.

The v0.1 CLI does not execute arbitrary tool-owned resume commands. t2a continue validates first and then prints the declared resume/continue guidance.

T2A must not call external LLM APIs or require model provider credentials.

There aren't any published security advisories