Skip to content

Security: ardakocadoru/agenthawk

Security

SECURITY.md

Security Policy

Supported Versions

AgentHawk is currently in early development. Security fixes are applied to the latest release only.

Version Supported
0.1.x (latest) Yes
< 0.1.0 No

Reporting a Vulnerability

Please do not report security vulnerabilities through public GitHub issues.

If you discover a security vulnerability in AgentHawk — including false negatives that could cause dangerous code to go undetected, bypass techniques against existing detectors, or vulnerabilities in AgentHawk's own dependencies — please report it privately.

Contact: ardakocadoruu@gmail.com

Include in your report:

  • A description of the vulnerability and its potential impact
  • Steps to reproduce the issue, including any relevant code samples
  • The AgentHawk version affected
  • Any suggested mitigations or fixes you have in mind

You will receive an acknowledgement within 48 hours and a more detailed response within 7 days outlining the next steps. We will keep you informed as the fix is developed and released.


Response Timeline

Stage Target time
Initial acknowledgement 48 hours
Vulnerability confirmed / triaged 7 days
Fix developed 14 days (for critical issues)
Fix released Coordinated with reporter
Public disclosure After fix is available

We follow responsible disclosure: vulnerabilities are disclosed publicly only after a fix is released or an agreed-upon deadline has passed.


Scope

In scope for security reports:

  • False negatives — vulnerable patterns that AgentHawk fails to detect
  • Detection bypass techniques — constructs that defeat an existing detector
  • Vulnerabilities in AgentHawk's own code (e.g., malicious input causing unsafe behaviour during scanning)
  • Supply chain issues in AgentHawk's direct dependencies

Out of scope:

  • Vulnerabilities in the AI agent frameworks themselves (LangChain, AutoGen, etc.) — report those to the respective projects
  • Issues only reproducible on unsupported Python versions

Credits

We are happy to credit reporters by name (or GitHub handle) in the release notes for the fix, unless you prefer to remain anonymous.

There aren't any published security advisories