Please report security problems privately. Do not open a public issue or pull request for them.

1. Use GitHub's private vulnerability reporting: open the Security tab of this repository and choose "Report a vulnerability".
2. Or email the contact published in security.txt: Contact: mailto:security@getmarrow.ai.

Please include what you found, the version or commit, and the steps to reproduce it. Do not include real credentials, API keys or other people's data; use test accounts and dummy values.

In scope:

• the @getmarrow/install npm package built from this repository: the marrow-install installer and governed runner;
• everything it writes into an agent host's configuration (MCP entries, hooks, settings), and how it pins and verifies the packages it installs;
• how it handles Marrow API keys in the files it creates or updates;
• the GitHub Actions workflows and the release process of this repository.

Also welcome through the same contact: findings about the hosted Marrow AI service and website at getmarrow.ai.

Out of scope:

• denial-of-service or volume testing, spam, social engineering and physical attacks;
• problems that need an already compromised machine, account or key;
• software we do not publish (MCP clients, agent hosts, npm, GitHub): please report those to their owners;
• scanner output without a demonstrated impact.

Test only against your own installs, keys and accounts. Do not access other people's data, and stop at the minimum needed to show the problem. Please check the latest release first, and keep the details private until a fix has been released.