Use GitHub's private vulnerability reporting feature under Security. Do not open a public issue for an unpatched vulnerability.

Include the affected version, reproduction steps, and expected impact. The maintainer will acknowledge the report within seven days.

Mobius starts agent and validation processes with the permissions of the current user. It does not create a security boundary, elevate privileges, store credentials, or upload run state.

Built-in agent adapters pass prompts through stdin. Custom adapters may place prompts in command arguments when they use the {prompt} placeholder.

Validation entries in mobius.config.json are shell commands. Review configuration from an untrusted repository before running Mobius.

Objectives, agent output, and validation output may be stored under .mobius/runs/. Do not put credentials or private data in an objective.