Please do not open public issues for security vulnerabilities.

Please email security@agentcabin.com with a description of the vulnerability, reproduction steps, and any relevant logs or patches.

This policy covers the AgentCabin desktop application itself (Tauri, Rust backend, Svelte frontend). Vulnerabilities in upstream CLIs (Claude Code, Codex) should be reported to their respective maintainers.

• Acknowledgment: within 72 hours of report
• Fix: a patch release will be issued as soon as a fix is ready

Vulnerabilities will be publicly disclosed after a fix has been released.