agent-ultra-kit executes model-authored commands on a host. That capability is made safe by defaults (see docs/security.md); please help keep it that way.

Do not open a public issue for an exploitable vulnerability.

Report it privately through GitHub's Report a vulnerability button under the repository's Security tab (this opens a private advisory). Include a minimal reproduction and the version (python -c "import agent_ultra; print(agent_ultra.__version__)").

Examples of what to report privately:

• a way to make a DANGEROUS command auto-run without an approver or sandbox
• a secret shape that slips past redact_secrets() into a ledger or artifact
• a classifier bypass that mislabels a destructive command as SAFE/ELEVATED
• any path that executes untrusted model output without going through the broker
• a leak-gate input or error that causes a false PASS

Non-sensitive hardening ideas, safer-default suggestions, and docs fixes can go in a public issue via the Security concern template.

The command broker is a heuristic risk router, not a shell parser, identity provider, or sandbox. The trusted-owner policy intentionally auto-runs ELEVATED and unknown commands; only critic mode is the untrusted-input default. A configured sandbox backend is trusted to provide its own isolation because the broker does not verify containment. A finding is in scope when it defeats a documented guarantee: dangerous host execution without approval, critic-mode gating, durable-field redaction, fail-closed leak scanning, or the proof-gate ship check. See the detailed limitations.

Pre-1.0: only the latest release (and main) receive fixes.