Follow the kagent security policy.

Report potential vulnerabilities privately to kagent-vulnerability-reports@googlegroups.com. Include the harness name, affected version or commit, reproduction steps, and the impact you observed. Do not put credentials or undisclosed vulnerabilities in public issues.

For vulnerabilities in an upstream framework or dependency, follow that project's security reporting process, as described in kagent's policy.

Harnesses in this repository are community experiments. Their READMEs document compatibility and limitations; inclusion here does not establish a security support window.