The first public beta is 0.6.1. Security fixes will target the latest beta; older releases are not promised backports.

Use Agent Board on GitHub → Security → Report a vulnerability for private reports. GitHub Private Vulnerability Reporting is planned for activation during publication; this release-preparation tree does not claim that it is already enabled. Do not open a public issue with credentials, private conversations, endpoint URLs, personal identifiers, raw prompts/responses, or an unredacted exploit against a live installation.

A private report should describe the affected version, minimal synthetic reproduction, expected behavior, observed behavior, and impact.

Plugins execute with BB's trust. See README privacy and trust boundaries; preview redaction is defense in depth, not a guarantee that arbitrary text is safe.