Vulnerability disclosure

Report security problems privately. Don't open a public issue, discussion, or pull request that describes a vulnerability.

Where to report

Component	How to report
The engine, agent, launcher, and other public repositories	GitHub private vulnerability reporting on the affected repository: Security → Report a vulnerability. For the engine, report it here.
app.openadapt.ai, the managed runner, and other hosted services	Email hello@openadapt.ai with "Security" in the subject.

If you can't use either, open a public issue with no details that asks a maintainer to contact you privately.

What to include

Include the affected component, route, or repository; the version or commit; the impact; steps to reproduce; and any suggested fix. Don't send live customer data, credentials, or screenshots in the first message. A secure way to transfer evidence will be arranged if it's needed.

What to expect

• An acknowledgment within 5 business days.
• An estimated timeline for a fix, and updates as it progresses.
• Credit after the fix ships, if you want it.
• Fixes go into the latest release. There is no long-term support branch.

Please allow reasonable time to fix the problem before you disclose it.

Scope notes

In scope for the hosted services: tenant isolation failures, sign-in or MFA bypasses, exposed secrets, ways to get an artifact accepted without approval, escapes from the managed runner or its network limits, access across organizations, billing bypasses, and supply-chain findings.

For the engine:

• Bundles and report.json keep literal record identifiers on purpose, inside your boundary. Exposure outside that boundary is in scope.
• Identity crops sent to an on-premises model server aren't scrubbed. Reports of those crops being kept or sent outside your network are in scope.
• GitHub Actions are pinned by commit SHA. Reports of a pinning gap are welcome.