| Version | Supported |
|---|---|
| 1.x.x | ✅ |
| < 1.0 | ❌ |
Please do NOT report security vulnerabilities through public GitHub issues.
Instead, report them via email to security@agentix.dev (or the project maintainer's security contact).
We aim to:
- Acknowledge receipt within 24 hours
- Provide an initial assessment within 72 hours
- Release a fix within 7 days for critical vulnerabilities
- Coordinate disclosure with the reporter
- All dependencies pinned with exact versions in
pnpm-lock.yaml - CodeQL static analysis runs on every push to main and every PR (security-extended + security-and-quality queries)
- Dependency review runs on every PR, blocking known-vulnerable dependencies
- SBOM generation produces SPDX 2.3-compliant bills of materials for every release
- npm provenance enabled — packages are built and published with verifiable build attestations
- Cosign signing for Docker images — all container images are cryptographically signed
- Regular
npm audit/pnpm auditruns on every PR via CI
- CodeQL static analysis runs on every push to main and every PR
- No secrets or credentials in source code
- All user input is validated and sanitized
- SQL injection prevention via parameterized queries
- No
eval()or dynamic code execution on untrusted input
- MCP server supports API key authentication
- Rate limiting on all MCP tools
- Tool-level access policies (read-only, read-write, admin profiles)
- Request logging for audit trails
- Worker processes run in isolated child processes
- File system access is scoped to configured project directories
- No arbitrary command execution from external input
- No user code leaves the machine (all analysis is local)
- Embedding vectors are stored locally
- Knowledge graphs are stored in local SQLite databases
- Network requests only for GitHub API (when configured) and optional LLM features
| Severity | Response | Fix | Disclosure |
|---|---|---|---|
| Critical | 24 hours | 7 days | Coordinated |
| High | 48 hours | 14 days | Coordinated |
| Medium | 1 week | 30 days | Public |
| Low | 2 weeks | 90 days | Public |
- API Keys: Always use API key authentication when exposing the MCP server
- Network Binding: Bind MCP server to
localhostonly unless you have a specific need - Rate Limiting: Configure appropriate rate limits for your use case
- Tool Policies: Use the most restrictive tool policy profile that meets your needs
- Regular Updates: Keep Code Analyzer updated to the latest version
- GitHub Tokens: Use fine-grained GitHub tokens with minimal scopes