Repository navigation

Security

docs/SECURITY.md

Security Policy

Reporting a Vulnerability

If you discover a security

Please do not file public issues for security vulnerabilities.

Response Time

We aim to acknowledge reports within 48 hours and provide a fix or mitigation within 7 days.

Scope

The OpenSkynet agent core, browser automation, and skill execution system
The FastAPI server and RPC server
The Rust TUI bridge
Docker and deployment configurations

Out of Scope

Third-party dependencies (report to upstream maintainers)
Issues in skills authored by community members (report to the skill author)
Self-hosted infrastructure misconfigurations

There aren't any published security advisories