Use GitHub private vulnerability reporting for suspected vulnerabilities. Do not disclose them in public issues, pull requests, or comments.

If you cannot use that form, email support@abruption.dev with [session-peer] Security in the subject. Email is an alternative private contact channel, not an end-to-end encrypted submission mechanism. Start with a redacted description; do not send live secrets or production data.

Include the affected version or commit, installation method, OS, Python and agent versions on each endpoint; the affected command or component; required attacker access; expected and observed behavior; impact; and a minimal reproduction using dummy accounts, paths, sessions, and messages.

Remove tokens, passwords, private keys, pairing secrets, conversation text, session/thread identifiers, personal paths, hostnames and addresses from diagnostics. Use consistent placeholders where relationships matter. Do not upload complete agent homes, SQLite databases, JSONL transcripts, browser profiles, or .env files. Revoke or rotate exposed secrets through the relevant provider; deleting a public comment alone does not invalidate them.

Reports are reviewed manually on a best-effort basis; no response or fix deadline is guaranteed. Reports about any version are welcome. Maintenance focuses on the latest session-peer release; older versions and the legacy cc-peer package do not have a guaranteed backport policy.

The maintainer will coordinate investigation and disclosure with the reporter. Private reports and emails are not automatically converted into public issues. English and Korean reports are welcome.

For ordinary bugs and feature requests, use the public issue templates.

Dependabot version updates are configured weekly for Python requirements, control/ npm dependencies and GitHub Actions. Minor/patch updates are grouped; major updates remain separate reviewed PRs. This configuration does not enable auto-merge or change GitHub's separate vulnerability-alert/security-update settings. Existing dependency audits remain in place.

The secret-scan workflow scans full fetched Git history with checksum-pinned Gitleaks CLI on PRs, main pushes, weekly schedules and manual dispatch. Output is redacted; no secret-report artifacts are uploaded. The small documented allowlists cover only translation digests and a historical non-secret increment expression. A clean scan is not proof that no credential has ever been exposed. The separate scheduled dependency audit runs every Monday at 06:23 UTC and can be started manually with workflow_dispatch. It audits the Python relay,mcp runtime dependencies in an isolated environment with pip-audit and the control/ Node runtime dependencies with npm audit --omit=dev. Findings and audit errors fail that audit run and remain visible in job summaries and downloadable JSON/log artifacts retained for 30 days. This workflow does not run for pull requests or participate in the CI release-gate; existing CI and release audits still apply.