Security is our top priority. We take all security vulnerabilities seriously.

Please DO NOT report security vulnerabilities through public GitHub issues.

Report via GitHub Security Advisories:

👉 https://github.com/agentguard-ai/tealtiger/security/advisories/new

If you get a 404 error (Security Advisories not enabled), please:

1. Open a GitHub issue with the title prefix [SECURITY] (do NOT include sensitive details)
2. We will contact you privately to discuss the vulnerability details

• Type of vulnerability (e.g., pattern bypass, policy evasion, evidence tampering)
• Full paths of source file(s) related to the vulnerability
• Step-by-step instructions to reproduce the issue
• Proof-of-concept or exploit code (if possible)
• Impact of the vulnerability and how an attacker might exploit it

• No LLM in the governance path — Governance decisions are deterministic regex/pattern-based. The governance layer cannot be prompt-injected.
• Deterministic decisions — Same input + same policy = same decision, every time. Reproducible and auditable.
• SDK-only architecture — No external infrastructure dependency. No data leaves the process unless explicitly configured (telemetry export).
• Fail-closed by default — TealEngine's parallel evaluation uses "most restrictive action wins" merge.
• FREEZE Rules — Immutable emergency kill switches that cannot be overridden by any policy layer. Includes tamper detection to alert on modification attempts.
• Anti-Tamper Controls — Ed25519-signed policy bundles, forbidden config key rejection, and workload identity binding prevent unauthorized governance modifications.
• OWASP Agentic Top 10 Coverage (10/10) — Zero-config policy pack covering all 10 OWASP ASI risks (ASI-01 through ASI-10).

TealTiger's primary threat model addresses attempts to weaken, bypass, or tamper with governance enforcement.

• A developer CAN remove the SDK from their application entirely. This is detectable (missing evidence) but not preventable at the SDK layer alone.
• Pattern-based detection has recall limitations (currently 50% on PINT benchmark). Novel attack phrasing can evade detection.
• The SDK trusts the configured registry endpoint. If the registry itself is compromised, governance artifacts could be tampered with.

For the full threat model, see: TealTiger-SOT/diagrams/tealtiger_threat_model_policy_tampering.md

• Code Review — All changes reviewed before merge
• Automated Testing — Security-focused test suite including adversarial probes
• Dependency Scanning — Regular audits (npm audit, pip audit)
• Static Analysis — Automated scanning in CI/CD
• Red Team Benchmarking — Garak + PINT benchmarks run on every release

Development checklist:

• Store API keys in environment variables (never in code)
• Keep SDK updated to latest version
• Enable all guardrails appropriate for your use case
• Review governance decisions in REPORT_ONLY mode before enabling ENFORCE
• Set cost budgets appropriate for your workload

Production checklist:

• Enable ENFORCE mode for all critical guardrails
• Configure cost budgets with hard limits
• Export audit evidence to your SIEM
• Monitor for governance decision anomalies
• Rotate API keys regularly
• Use separate keys per environment

We follow coordinated disclosure:

1. Report — Researcher reports vulnerability privately
2. Acknowledge — We acknowledge within 24 hours
3. Fix — We develop and test a fix
4. Release — We release the fix
5. Disclose — We publicly disclose (coordinated with researcher)

We credit security researchers in:

• Security advisories
• Release notes
• Security Hall of Fame (below)

We recognize security researchers who help us improve:

No vulnerabilities reported yet — be the first!

• Security Issues: GitHub Security Advisories
• GitHub: agentguard-ai/tealtiger

Thank you for helping keep TealTiger secure! 🔒