agentgov is a governance and audit library — security and correctness are the product. We take reports seriously.

Please do not open a public issue for security vulnerabilities.

Instead, report privately via GitHub's private vulnerability reporting ("Report a vulnerability" under the repository's Security tab).

When reporting, please include:

• A description of the issue and its impact.
• Steps to reproduce (a minimal example is ideal).
• The version / commit affected.

We aim to acknowledge reports within a few business days and will keep you updated as we work on a fix.

Because the audit trail is the product, we especially want to hear about:

• Ways to commit a state transition that bypasses a hard rail.
• Ways to tamper with the event log without breaking verify_chain.
• Ways to forge or alter an EvidenceBundle that still passes verify_bundle.
• Replay non-determinism that lets a recorded run reproduce a different state_hash.