Security Policy

Supported Versions

Agent Feed is currently pre-1.0. Security fixes target the latest released version.

Reporting A Vulnerability

Please do not open a public issue for a suspected vulnerability.

Use GitHub private vulnerability reporting if it is enabled for the repository. If it is not enabled yet, contact the repository owner directly through the contact method listed on the GitHub profile.

Scope

Security-sensitive reports include:

1. Unsafe overwrite or deletion of user files.
2. Generated instructions that could cause AI tools to expose secrets or perform destructive actions.
3. Packaging or release process compromise.
4. Dependency issues that affect the installed CLI.

Agent Feed does not run a hosted service and does not collect user data.