Please do not open a public issue for security vulnerabilities.

Email the maintainer at 335509995@qq.com with:

• A description of the vulnerability and its impact
• Steps to reproduce (proof-of-concept if possible)
• Affected version / commit

You can expect an initial acknowledgement within 72 hours. Once the issue is confirmed and a fix is ready, we will coordinate a disclosure timeline with you.

AgentCMS handles authentication, payments, and user data, so we take the following especially seriously:

• Authentication / authorization bypass (admin, agent API key, public auth)
• Payment tampering (amount manipulation, callback forgery, double-grant)
• Tenant isolation breaks (cross-tenant data access)
• Secret exposure (credentials stored unencrypted, secrets in logs)
• SSRF, SQL injection, XSS, RCE

This project is pre-1.0. Only the latest main is supported with security fixes until a stable release line is established.