This policy applies to repositories in the agent-passport-system organization that do not have their own SECURITY.md. Where a repository has its own policy, that policy applies.

Use the repository's Security tab, then Report a vulnerability. This submits the report privately through GitHub.

If that is not possible, email signal@aeoess.com with "security" in the subject.

Please do not open a public issue, pull request or discussion about a vulnerability.

• the repository and the commit or release you tested
• steps to reproduce, or a minimal proof of concept
• the impact you observed
• a suggested fix, if you have one

The maintainer will review the report and coordinate next steps and disclosure timing with you. With your permission, confirmed contributions will be credited.

This policy covers code and published packages in this organization. Please report dependency vulnerabilities that affect these projects, including how the dependency is used. Fixture and demo keys are intentionally public. Their publication alone is not a vulnerability, but unintended trust in those keys may be.