Use private vulnerability reporting — GitHub's "Report a vulnerability" button on the Security tab. It opens a private thread visible only to maintainers.

Please do not open a public issue for anything that lets someone read another user's data, escape the budget ceiling, or reach a secret.

Expect a first response within a week. This is a small project; there is no on-call rotation and no bug bounty, and saying so plainly is more useful than implying otherwise.

Running it means giving it, at minimum, a model provider API key with billing attached. Depending on configuration it may also hold a GitHub token, an SMTP password, and a database with the full text of everything it retrieved.

Concretely:

• .env holds live credentials. It is gitignored, and .env.example carries names with empty values. Verify before your first commit, not after.
• Model spend is real money. Every run takes maxModelCostUsd, enforced by a pre-dispatch estimator that refuses to start a task it cannot afford. A second, independent guard (scripts/cost-guard.ts) polls actual spend and force-cancels. Two mechanisms because the first one is inside the thing being guarded.
• The agent fetches and parses untrusted content. Paper abstracts, README files and source code from arbitrary repositories all reach a model prompt. Treat retrieved text as data, never as instruction, and assume a retrieved document may try to be one.
• Logs and database rows contain retrieved content. A run's source documents are stored in full. Before sharing a database dump or a log bundle, read it.

Redact before you paste. The lesson behind this section was learned the expensive way, twice, in this project's own tooling:

• A redaction regex matched a variable's value rather than its name, and printed the key it was written to hide.
• A second one only masked text appearing after =, and a token that sat on its own line went through untouched.

The rule adopted afterwards, which is worth borrowing: diagnostic output prints booleans, lengths, and prefixes — KEY_SET=true, length=51, starts_with=sk-. Never the value. If you are about to paste a config file into an issue, assume it contains something it should not.

If you believe a credential of yours was exposed through this project, rotate it first and report second. Rotation is the only fix; a deleted message is not.

The master branch. There are no releases yet, so there is nothing else to backport to.