| Version | Supported |
|---|---|
| 0.1.x | ✅ |
Do not open a public issue. Instead, email the maintainer directly.
If you discover a security vulnerability in agent-forge, please report it privately. We will acknowledge your report within 48 hours and provide a timeline for a fix.
Security concerns relevant to agent-forge include:
- Shell injection via unsanitized engine commands or prompt input
- Arbitrary git worktree manipulation outside
.forge/ - OpenRouter API key exposure via logs or error messages
- SQL injection via forged task/run metadata
When in doubt, report it.