AgentOps Workbench is an experimental local MVP. It is not production ready and does not currently provide production authentication, authorization, hosting, or deployment hardening.

Security reports are still welcome, especially when they concern:

• unsafe filesystem reads or writes;
• path traversal or archive handling;
• credential or environment-variable exposure;
• approval, publication, or rollback gate bypass;
• untrusted input reaching command or subprocess execution;
• generated artifact integrity;
• audit-evidence corruption; or
• dependency vulnerabilities with a demonstrated project impact.

Security fixes target the latest commit on the default branch. Historical branches, generated workspaces, and local experimental artifacts are not separately supported.

Please do not open a public issue with exploit details.

Use GitHub private vulnerability reporting from the repository's Security tab and create a private draft advisory. If private reporting is unavailable, email the primary maintainer at zz13240206005@gmail.com and share only enough information to establish a private reporting channel.

Include:

• affected commit or version;
• affected files or component;
• reproducible steps or a minimal proof of concept;
• expected and observed behavior;
• impact and realistic attack conditions; and
• any suggested mitigation.

Do not include real credentials, unrelated personal data, or destructive payloads.

The maintainer will review reports on a best-effort basis, confirm whether the issue is reproducible, and coordinate a fix and disclosure plan when warranted. The project will not claim a fix until regression evidence is available.

Generated artifacts are candidates only. Evaluation, explicit human approval, version records, and rollback-ready evidence remain required before controlled publication. A passing test or generated report is not itself production authorization.