Security advisories

Every published security advisory for Decionis and AgentSafe: what it affected, the release that fixes it, and what to do. An advisory appears here once its fix has shipped. Each one links to its GitHub Security Advisory, which is the record your dependency scanners read.

Published advisories

No advisory is published yet. A finding is listed here, and in the findings ledger, once the release that fixes it has shipped.

The full record

The AgentSafe findings ledger records every fixed finding, including those found internally that needed no advisory: what was wrong, what it allowed and what limited it, the fix, and the regression test that fails without it.

Reporting a vulnerability

Email security@decionis.com, or for AgentSafe use GitHub's private reporting form. Please do not open a public issue. We credit reporters who want it, as they ask to be named; the security policy gives the response targets.