AgentCrewKit is currently an alpha release. Security fixes are provided for the latest 0.1.x release line.

Do not report vulnerability details in public GitHub issues. Start with the security contact request form, which creates a detail-free request for maintainers to establish a private reporting channel. In the private report, include:

• The affected AgentCrewKit version and environment.
• A minimal reproduction or proof of concept.
• The expected impact and any known mitigations.
• Whether the issue is already public or actively exploited.

The contact request is public, so it must not contain vulnerability details, proof-of-concept code, credentials, or sensitive data.

Maintainers will acknowledge valid reports on a best-effort basis, investigate the impact, and coordinate disclosure before publishing a fix. Do not include real API keys, private model output, or other sensitive user data in a report.

• Model, task, memory, and tool output must be treated as untrusted data.
• Tool registration and an agent allowlist reduce capability exposure but are not a process sandbox.
• Human approval is a workflow decision gate, not permission to execute unsafe code.
• SQLite memory is plaintext and may contain prompts or model output.
• v0.1.0 does not provide shell execution, unrestricted filesystem access, or dynamic plugin imports.

Applications embedding custom or side-effecting tools are responsible for authentication, authorization, timeouts, isolation, auditing, and an approval boundary appropriate to those tools.