Please report vulnerabilities through this repository's GitHub Security → Report a vulnerability flow. If that flow is unavailable, open an issue asking for a private reporting channel, without exploit details, credentials or private repository contents.

Include the Rove Memory version or commit, the platform, reproduction steps and the impact. Never include real memory contents, tokens or credentials.

What the tool is meant to guarantee — memory goes only to the configured repository, an agent publishes only its own folder and its own commits, and what is pushed was validated — is described in the README's "How memory stays safe". A way around any of those is a security issue. The project has no published response-time guarantee.