Private reporting
Report through GitHub Security → Report a vulnerability. Do not open a public issue for security problems.
Trust
Security & Disclosure
Available nowReport vulnerabilities privately and use only synthetic data in every report.
Safe research
Reports should include an affected version, reproduction steps, impact, and proof of concept using synthetic data only.
Scope
Pre-scrub exposure, Session Map exposure, cross-tenant access, auth bypass, SSRF, placeholder injection, reachable dependency issues, and secrets exposure are in scope.
Development & Supply Chain Security
Aegis enforces strict branch protection rules. The default branch requires passing CI/CD status checks and blocks force-pushes to maintain an immutable audit log of all source code changes.