Please report security issues privately through GitHub's private vulnerability reporting rather than opening a public issue. I'll acknowledge within a few days.

Worth understanding before you deploy it, because this system holds your pipeline and can spend your API budget.

• Nothing secret is committed. brand/brand-pack.yaml (your positioning and ICP), .managed-agents.json (your provisioned resource ids), .env*, and all run outputs are gitignored. The tracked brand-pack.example.yaml describes a fictional company.
• Agents never see credentials. The Resend key and the CRM's MCP bearer are stored in a Managed Agents vault and substituted at egress, so they do not exist inside the agent sandbox.
• Every CRM door fails closed. If a door's secret is unset, that door returns 401 rather than opening — cron (CRON_SECRET), MCP (MCP_TOKEN), agent ingest (INGEST_TOKEN), and the operator UI (CRM_PASSWORD). With no CRM_PASSWORD set, the CRM stays open only on a dev server (next dev); on any production host it returns 503 rather than publishing your pipeline. The operator doors also refuse cross-site state-changing requests (CSRF). Covered by tests in tests/proxy.test.ts.
• Agent output is treated as untrusted. It reaches spreadsheets, email, and the browser, so exports neutralize formula injection, the morning brief escapes every interpolated value, and the auto-add path whitelists fields rather than spreading whatever the model emitted. The research agents are told web-page text is data, not instructions; and the weekly digest sends through a crm_send_digest tool with a server-side recipient and no mail credential in the agent, so text planted on a researched page cannot redirect the email.

• Set CRM_PASSWORD before your first production deploy.
• Use distinct, long random values for CRON_SECRET, MCP_TOKEN, and INGEST_TOKEN.
• The CRM holds real contact data about real people. Treat the Blob store and your exports accordingly, and check your obligations under GDPR/CCPA before you run outreach at any volume.