Workcell is pre-1.0 software. docs/threat-model.md lists known, deliberate gaps (Docker is not a hard sandbox boundary, command policy is a speed bump, egress mediation is opt-in, etc.) — those are already tracked and don't need a separate report. If you find something not already listed there, please report it.

Preferred: open a GitHub Security Advisory on this repository (private to maintainers until published).

Alternative: email birand@pensor.tech with a description, reproduction steps, and impact. Please don't open a public issue for anything that could let one scope read, write, or execute in another scope's workspace, or that could exfiltrate credentials.

• Cross-scope isolation breaks (workspace, credential, audit)
• Credential handling: encryption, secret redaction, grant/materialization logic
• Authentication/authorization bypasses (HTTP signing, admin bypass, scope checks)
• Command injection or path traversal in the terminal/file tools
• Anything that defeats the documented boundaries in docs/threat-model.md — not the boundaries it already admits don't exist yet

This is a solo-maintained project. There's no SLA, but reports get triaged and acknowledged, and fixes ship as soon as reasonably possible for anything confirmed. Credit is given in the fix's release notes unless you'd rather stay anonymous.