agent-vault ships as obsidian-agent-vault on PyPI and takes its version from agentvault/_version.py. Only the latest published release is supported with security fixes; there is no long-term-support branch. If you're running an older version, upgrade before reporting an issue unless you've confirmed the problem still reproduces on main.

Please do not open a public GitHub issue for a security report — an issue is visible immediately and this project has no embargo process to protect you in the meantime.

Instead, report privately using GitHub's private vulnerability reporting:

1. Go to the repository's Security tab.
2. Click Report a vulnerability.
3. Describe the issue, how to reproduce it, and its impact.

If that isn't available for any reason, open a regular issue that says only "security issue, requesting a private channel" with no details, and a maintainer will follow up with an alternative.

Include, if you can:

• The version (agent-vault --version, pip show obsidian-agent-vault, or agentvault/_version.py when testing a source checkout).
• Reproduction steps or a minimal example.
• What you'd expect to happen instead.

You do not need to (and should not) attach a real session transcript to a report. If the issue is adapter-specific, agent-vault report <path> produces a structure-only diagnostic bundle with no transcript content — see docs/ADAPTERS.md and docs/COMPATIBILITY.md for what it does and doesn't include. Attach that instead.

There's no bug bounty program. Reports are handled on a best-effort basis by volunteer maintainers.

The bundled agent-vault core and bundled adapters are local-only. By design:

• The bundled code never makes a network request. It reads local provider session stores (JSONL files, SQLite databases) and writes local Markdown files into a vault directory you configure. There is no telemetry, no update checker, no phone-home of any kind.
• Bundled provider adapters (agentvault/adapters.py) and the fixture sanitizer (agentvault/sanitize.py) open their source files read-only. A bug that causes a provider's session store to be modified or corrupted is a security-relevant bug, not just a functional one — report it as such.
• Third-party adapter plugins are trusted local Python code loaded from the user's installed environment. They execute with the same filesystem, process, and network permissions as agent-vault and are not sandboxed. The bundled core cannot guarantee that a plugin avoids network access or opens provider sources read-only. Install only plugins you trust; use agent-vault --no-plugins <command> ... for bundled-only runs.
• agentvault/store.py's manifest-driven sync only ever touches files it created and tracks by content hash; it refuses to delete files it doesn't own. A bug that causes it to delete or overwrite an unmanaged file (a hand-written vault note, in particular) is in scope.
• agent-vault schedule install|status|remove (agentvault/schedule.py) shells out to schtasks.exe or writes a crontab line. remove only touches entries carrying agent-vault's own marker (AgentVaultArchive / # agent-vault:managed); a bug that causes it to touch an unrelated scheduled task or crontab entry is in scope.
• Config files (agent-vault.json) and fixtures can contain filesystem paths from your machine. redact_patterns in the config lets you scrub content before it's rendered or hashed — a bug in that redaction path (content that should have been scrubbed but wasn't) is in scope.

Out of scope: anything requiring the attacker to already have local code execution or filesystem write access equivalent to the user running agent-vault, since the tool has no privilege boundary to defend at that point. Also out of scope: the correctness of Obsidian itself, or of upstream agent tools' session file formats.