From b8a52f68af64deb74cb7a0a9ef7607b35f962eaf Mon Sep 17 00:00:00 2001 From: Asmit-Singh-01 Date: Mon, 20 Jul 2026 22:15:59 +0530 Subject: [PATCH] Update security guidelines for adapter output handling Emphasize the importance of treating output from adapters as untrusted. --- SECURITY.md | 1 + 1 file changed, 1 insertion(+) diff --git a/SECURITY.md b/SECURITY.md index 92b5c22..a24d4f1 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -53,6 +53,7 @@ Send an email to **opensource@openagenthq.com** with: - Never commit secrets or `.env` files (see `.gitignore`). - Raise typed `ModelDockError` subclasses — never swallow errors silently. - Run `bandit -r src` as part of local checks. +- Treat output from adapters, particularly from the cli/core/adapters/docs module, as untrusted; never execute or evaluate it directly. ## Contact