AgentPostmortem is a continuously deployed web application. Only the code on the
main branch, which powers the live site at https://www.agentpostmortem.com/,
receives security fixes. Older commits, forks, and tagged releases are not
patched.
| Version | Supported |
|---|---|
main (live site) |
Yes |
| Older tags / forks | No |
Please report security issues privately. Email:
Use the subject line SECURITY: agent-postmortem and include:
- a description of the issue and its impact,
- the affected URL, endpoint, or file path,
- steps to reproduce (a proof of concept helps),
- anything you think a fix should account for.
Do not open a public GitHub issue, pull request, or discussion for a vulnerability. Public reports expose users before a fix can ship. If you have already opened one, email the address above and it will be taken down.
- Acknowledgement within a few days of your report.
- An assessment and a planned fix window once the issue is confirmed.
- A follow-up when the fix is deployed.
- Credit in the release notes if you want it, or anonymity if you prefer.
In scope: this repository's source code and the live site at
agentpostmortem.com.
Out of scope: findings that require a compromised user device, social engineering of maintainers, volumetric denial-of-service testing, and reports generated by automated scanners with no demonstrated impact. Vulnerabilities in third-party services the site depends on (Cloudflare, Supabase, Resend) should be reported to those vendors directly.
Please do not access, modify, or delete data belonging to other people while testing. Report what you find and stop.