MiSec / TrustOps Agent is built for enterprise-owned assets and explicitly authorized security analysis. Do not use this project to scan, probe, exploit, or collect data from systems where you do not have permission.

Security fixes are accepted for the main branch. Release candidates are treated as active development snapshots unless a release note states otherwise.

Use GitHub Security Advisories when the repository is public. If that is unavailable, contact the maintainers through the private channel listed on the project profile or organization page.

Please include:

• affected commit, branch, or release
• component and deployment mode
• clear reproduction steps
• expected and observed behavior
• impact assessment
• sanitized logs, screenshots, or payloads

Do not include real customer data, production credentials, live tokens, private keys, unredacted reports, or evidence from targets you are not authorized to test.

In scope:

• authentication, authorization, tenant isolation, and secret handling issues
• command execution boundary bypasses
• unsafe defaults in production deployment paths
• report/evidence integrity issues
• dependency or container hardening issues that affect MiSec deployments

Out of scope:

• reports against targets you do not own or have written authorization to test
• denial-of-service testing against public infrastructure
• social engineering, phishing, spam, or physical attacks
• findings that depend on disabled security controls or leaked credentials not caused by MiSec
• generic dependency reports without a reachable impact path

Good-faith research that stays within this policy, avoids privacy violations, avoids service disruption, and reports findings responsibly will be treated as authorized for the purpose of improving MiSec. This policy does not authorize testing against third-party systems.

• Keep real .env files, .secrets/, model weights, ChromaDB data, generated reports, screenshots, videos, and runtime exports out of Git.
• Rotate any credential that may have been committed, logged, pasted into an issue, or shared in a report.
• Production deployments should set strong values for DJANGO_SECRET_KEY, NODE_REGISTER_KEY, MCP_CALLBACK_SECRET, FIELD_ENCRYPTION_KEY, database passwords, and AI provider keys.
• Keep NEXT_PUBLIC_DEMO_TARGETS_ENABLED=false outside local demos.