FTP Agent edits website files and therefore belongs behind strong access controls. Treat a deployment as an administrative system, not as a public website feature.

Security fixes are provided for the latest tagged minor release. The current public-beta line is 0.1.x.

Use the repository's private security-advisory reporting feature when it is available. Do not publish exploit details, credentials, production URLs, audit logs, uploaded documents, or affected customer content in a public issue.

If private reporting is unavailable, open a minimal issue asking the maintainer to establish a private channel. Include no sensitive technical details in that issue.

• Serve only public/; use the root .htaccess only as a shared-hosting fallback.
• Require HTTPS and set SESSION_COOKIE_SECURE=true in production.
• Use independent high-entropy values for the app, webhook, and worker secrets.
• Keep .env, storage/, site backups, and target files out of version control.
• Restrict filesystem permissions and keep target roots outside the public directory.
• Leave approval enabled for production tasks, especially webhook-created tasks.
• Test rollback and retain secure off-site backups.
• Rotate a provider API key immediately if it may have entered a log, shell history, screenshot, or commit.
• Keep MAX_LLM_RESPONSE_BYTES at the smallest practical value; provider responses are untrusted and are rejected above this limit (1 MiB by default, 8 MiB maximum).

The project intentionally does not execute model-generated code. Its editing policy is still a safety boundary that deserves review before new tools or file types are added.