yoagent is pre-1.0. Security fixes land on the latest published minor version; there are no long-term support branches. Please upgrade to the newest release before reporting.

Please do not open a public issue.

Report privately through GitHub's private vulnerability reporting. If that is unavailable, email the maintainer at yuanhao@yolog.dev with "yoagent security" in the subject.

Please include the affected version, a description of the impact, and a reproduction if you have one. You can expect an initial response within a week.

yoagent handles API credentials and executes tools, so the areas most worth scrutiny are:

• Credential handling — API keys are resolved from environment variables and held in memory. yoagent does not log them. A path that leaks a key into logs, tracing output, error messages, or a serialized session is a vulnerability.
• Tool execution — the bash tool runs shell commands and the file tools read and write disk. These are designed to execute what the model asks for; that is the crate's purpose, not a flaw. A bypass of a configured restriction — ToolMiddleware denials, bash deny patterns, or file path restrictions — is a vulnerability.
• Deserialization — Session JSONL, MCP responses, and provider SSE streams all parse untrusted input. Panics or memory-safety issues there are in scope.
• MCP and OpenAPI adapters — these connect to third-party servers and turn their descriptions into tools the model can call.

• An agent taking a destructive action the model chose and no configured policy blocked. yoagent ships no default policy — ToolMiddleware is the mechanism, and installing a policy is the application's responsibility.
• Prompt injection causing an LLM to misbehave, absent a bypass of a yoagent-enforced restriction.
• Vulnerabilities in the upstream LLM providers themselves.