security policy

Report security issues privately to [email protected]. Include reproduction steps, impacted hosts or contracts, and any evidence that helps us verify quickly.

Preferred reporting path

Email [email protected] for coordinated disclosure.
Use GitHub Security Advisories for repository-tracked issues when appropriate.
Do not post exploit details publicly before the issue is acknowledged and remediated.

Scope

Scope includes the public resolver at agnt.id, the public API at api.agnt.id, published npm packages under @agnt-id/*, and the deployed registry/resolver/reverse contract surfaces documented in the repository.