If you believe you've found a security issue in AgentSync, please report it privately rather than opening a public GitHub issue.

• Open a private security advisory: https://github.com/__AGENTSYNC_LAUNCH_PLACEHOLDER__/agentsync/security/advisories/new
• Or email: security@AGENTSYNC_LAUNCH_PLACEHOLDER.example

We aim to:

• Acknowledge your report within 48 hours
• Provide a fix or mitigation timeline within 7 days
• Resolve critical issues within 30 days

You will receive public credit (unless you request anonymity) in the security advisory and release notes.

In scope:

• Code execution from .agentsync/ content
• Path traversal / file system escape
• Secret exposure via generated output
• Supply-chain risks in dependencies
• Crashes or data corruption from malformed input

Out of scope:

• Vulnerabilities in third-party AI agents themselves
• Issues requiring physical access to the user's machine
• Social engineering / phishing

AgentSync follows the Privacy & Security pillar of the project:

• Zero network calls in MVP — verified by CI: the network-free job in .github/workflows/ci.yml re-runs the test suite and a real agentsync init / build / check round-trip inside a Linux network namespace (sudo unshare -n). Any outbound DNS or socket call from the CLI would fail there with EAI_AGAIN / ENETUNREACH and break the build.
• Zero telemetry — no data collection, ever
• Strict file system allowlist — refuses to read/write outside the project
• Restricted templating — Nunjucks runs without a filesystem loader and without exposed globals, so templates cannot include other files or reach env/fs/process. We treat .agentsync/ content as trusted (it lives in your repo); a malicious template author can still reach JS internals via expressions like ({}).constructor, so do not paste untrusted templates into .agentsync/.
• Built-in secret detection — blocks builds that contain API keys
• Atomic file writes — temp file is fsynced before rename
• Reproducible builds — same input always produces byte-identical output

• Dependencies are minimal and audited (pnpm audit in CI)
• Lockfile committed
• Releases signed via npm provenance (sigstore)
• SBOM published per release

We follow coordinated disclosure. We will not publicly disclose details of a vulnerability until a fix is available and users have had reasonable time to update.

None yet.