As an enterprise security and secret defense tool for autonomous AI agents, AgentShield treats security with the highest level of priority. We welcome responsible security reports from researchers, security teams, and community members.
Only the latest active major and minor releases receive security patches and vulnerability mitigations.
| Version | Supported | Security Status |
|---|---|---|
0.1.x |
✅ | Current Active Release |
< 0.1 |
❌ | Deprecated |
Please DO NOT report security vulnerabilities through public GitHub issues, discussions, or pull requests.
- GitHub Private Security Advisory (Preferred):
- Navigate to Security Advisory and click "Report a vulnerability".
- Email (Alternative):
- Send an encrypted email with detailed reproduction steps to
security@ritualdev.labor through RitualDev Lab maintainers.
- Send an encrypted email with detailed reproduction steps to
- A clear description of the vulnerability (e.g. pattern bypass, sandbox escape, regex denial-of-service, or vault leakage).
- Minimal reproducible proof-of-concept (PoC) code or prompt payload.
- Affected environments (Node.js version, OS, agent tool runtime).
- Potential impact and threat vector.
- Acknowledgment: Within 24 to 48 hours.
- Assessment & Triage: Within 3 business days.
- Remediation & Patch Release: Critical vulnerabilities are prioritized with emergency patch releases within 7 business days.
- Coordinated Disclosure: We adhere to a 90-day coordinated disclosure policy, crediting reporters publicly in release notes upon publication.