Only the latest main branch is supported for security fixes.
Please report security issues privately to the maintainers when possible.
Preferred options:
- Use a private security advisory channel if one is configured on the hosting platform.
- If no private channel is available, open a minimal public issue requesting a private follow-up and avoid sharing exploit details.
This project is a local-first workflow orchestration toolkit. Security concerns include:
- secret handling and redaction
- prompt-injection or untrusted input handling
- local file access and write scope
- logging, task history, and generated artifact storage