AgentGuard is designed to reason about AI Coding Agent risk, so repository hygiene matters.

• .env files
• API keys, tokens, private keys, certificates, keystores
• Local .agentguard/ reports or backups
• Database dumps containing real project data
• Build outputs such as target/, dist/, and node_modules/

The backend reads database settings from environment variables:

Please open a private advisory or contact the repository owner before disclosing vulnerabilities publicly.

This project currently focuses on local development and security-governance workflows. Production deployments should add authentication, authorization, TLS termination, audit log retention policy, and explicit project path allowlists.