Use GitHub's private security-advisory flow for vulnerabilities. Do not open a public issue containing exploit details, credentials, private tenant data, or a reproduction against the hosted deployment.

Include:

• the affected route, module, or deployment surface
• the security boundary that failed
• impact and prerequisites
• a minimal reproduction using synthetic data
• any suggested containment

Reports should not test destructive behavior against infrastructure or data you do not own.

Security fixes target the current main branch and the hosted production workbench. The current framework includes retained-data lifecycle, WorkOS Vault credential brokerage, and policy-controlled mutation authority behind default-off feature and workspace gates. Real provider adapters require their own threat model and acceptance evidence; the repository does not claim real trading, Swordfish execution, remote executable installation, or exactly-once external effects.

• WorkOS AuthKit owns hosted authentication and browser sessions.
• Vercel derives identity server-side and signs facade requests.
• Cloudflare owns workspace membership, role enforcement, policy, audit, and tenant-scoped durable state.
• The browser never supplies trusted tenant IDs or credentials.
• Tool provider keys and runner signing secrets remain server-side.
• Cross-tenant reads return no resource details.

The production gates for encrypted secret custody, non-destructive migrations, retention, external mutation, and provider-specific execution are tracked in docs/implementation-roadmap.md, docs/migrations-and-retention.md, and docs/release-readiness.md.