Agent Workflow Observatory is a localhost-only static dashboard. It binds exclusively to 127.0.0.1, performs no network requests at runtime (all assets, including runtime marks, are inlined at build time), stores no credentials, and executes no shell commands from the browser surface.

Only the latest release on main receives security fixes.

Please report vulnerabilities privately via GitHub Security Advisories. Do not open a public issue for security reports.

You can expect an acknowledgement within 7 days. Please include a reproduction and the commit hash you tested.

• Issues requiring a non-default configuration that exposes the server beyond 127.0.0.1.
• Vulnerabilities in third-party runtimes the dashboard merely depicts.