AGENT-11

Security Policy

Last updated

The short version. Report anything you find through GitHub Security Advisories, privately. One person reads them. There is no bounty and no guaranteed response time, and this page will not pretend otherwise.

How to Report

Use the private advisory form on the framework repository: github.com/TheWayWithin/agent-11/security/advisories. It keeps the report private until there is a fix, which a public issue does not.

Please include:

  • What the issue is, and what an attacker could do with it
  • The steps to reproduce it, ideally from a clean install
  • The version or commit you found it on

What Is In Scope

  • The AGENT-11 framework in TheWayWithin/agent-11 — most usefully the install script, since that is the one piece of this project that runs a command on your machine
  • This website, agent-11.com

Out of scope, because they are not ours to fix:

  • Claude Code and the Anthropic API — report those to Anthropic
  • Netlify, GitHub and Plausible — report those to the vendor
  • What an AI model writes into your repository when you run a mission. Review its output; that is your call and your review, not a vulnerability in this framework

What to Expect

AGENT-11 is maintained by one person alongside other work. That sets honest expectations:

  • No bug bounty. Nothing is paid for reports
  • No service-level agreement. Reports are read and acted on as fast as one person reasonably can, which is not the same as fast
  • Credit in the advisory and the release notes if you want it, and not if you don't
  • Fixes ship as a normal release. The changelog records them

Please Don't

  • Run automated scanners against this site — it is a static marketing site
  • Test anything that degrades the service for other people
  • Access, modify or exfiltrate data that is not yours
  • Disclose publicly before there has been a chance to fix it

Machine-Readable Version

This policy is referenced from /.well-known/security.txt, per RFC 9116.