We take security seriously. If you discover a security vulnerability, please follow these steps:

1. Do NOT create a public GitHub issue

2. Email the security team at security@honeyjar.xyz with:

   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact assessment
   • Any suggested fixes (optional)

3. Expect a response within 48 hours

4. Coordinate disclosure timeline with maintainers

• Authentication/authorization bypasses
• Injection vulnerabilities (command, code, etc.)
• Secrets exposure risks
• Insecure default configurations
• Agent prompt injection vectors
• MCP server security issues

• Vulnerabilities in dependencies (report to upstream)
• Social engineering attacks
• Physical security issues
• Denial of service (unless critical)

This repository uses:

• TruffleHog - Secret detection
• GitLeaks - Secret scanning
• Dependabot - Dependency vulnerability alerts
• CodeQL - Static code analysis

The main branch is protected with:

• Required pull request reviews
• Required status checks
• No force pushes
• No deletions

• All secrets must use environment variables
• No hardcoded credentials in code
• .env files are gitignored
• Secret rotation procedures documented

1. Never commit secrets - Use environment variables
2. Validate all inputs - Especially in agent prompts
3. Sanitize outputs - Prevent information disclosure
4. Review MCP integrations - External APIs need security review

1. Use minimal required permissions
2. Validate data from external sources
3. Handle errors without exposing sensitive info
4. Test with mock data before production

Security updates are announced via:

• GitHub Security Advisories
• CHANGELOG.md updates
• Discord announcements (for critical issues)

Thank you for helping keep Loa secure!