AgentHawk is currently in early development. Security fixes are applied to the latest release only.
| Version | Supported |
|---|---|
| 0.1.x (latest) | Yes |
| < 0.1.0 | No |
Please do not report security vulnerabilities through public GitHub issues.
If you discover a security vulnerability in AgentHawk — including false negatives that could cause dangerous code to go undetected, bypass techniques against existing detectors, or vulnerabilities in AgentHawk's own dependencies — please report it privately.
Contact: ardakocadoruu@gmail.com
Include in your report:
- A description of the vulnerability and its potential impact
- Steps to reproduce the issue, including any relevant code samples
- The AgentHawk version affected
- Any suggested mitigations or fixes you have in mind
You will receive an acknowledgement within 48 hours and a more detailed response within 7 days outlining the next steps. We will keep you informed as the fix is developed and released.
| Stage | Target time |
|---|---|
| Initial acknowledgement | 48 hours |
| Vulnerability confirmed / triaged | 7 days |
| Fix developed | 14 days (for critical issues) |
| Fix released | Coordinated with reporter |
| Public disclosure | After fix is available |
We follow responsible disclosure: vulnerabilities are disclosed publicly only after a fix is released or an agreed-upon deadline has passed.
In scope for security reports:
- False negatives — vulnerable patterns that AgentHawk fails to detect
- Detection bypass techniques — constructs that defeat an existing detector
- Vulnerabilities in AgentHawk's own code (e.g., malicious input causing unsafe behaviour during scanning)
- Supply chain issues in AgentHawk's direct dependencies
Out of scope:
- Vulnerabilities in the AI agent frameworks themselves (LangChain, AutoGen, etc.) — report those to the respective projects
- Issues only reproducible on unsupported Python versions
We are happy to credit reporters by name (or GitHub handle) in the release notes for the fix, unless you prefer to remain anonymous.