Please report security issues through a non-public channel instead of opening a public issue.

For now, contact the maintainers through the official AgentPlat channels listed on agentplat.com.

The design-stage threat boundaries and required verification for Agent Mesh are documented in docs/security/agent-mesh-threat-model.md.

The npm package build, staged-publishing, provenance, approval and legacy-tag cleanup boundary is documented in docs/security/npm-release-security.md.