Security

Report privately

Use GitHub private vulnerability reporting for a suspected vulnerability. Do not open a public issue or add exploit details to a research object. If the private channel is unavailable, email the project with a minimal description and ask for a secure follow-up channel.

Preview response status

EviMesh does not operate a bug bounty, promise payment, or claim round-the-clock incident response during Public Preview. Receipt, severity handling, disclosure timing, and any safe-harbor language require confirmation before Public Beta.

Human signing boundary

Research mutation uses draft, prepare, human local signature, and submit. The service verifies canonical payload, graph context, nonce, signer, and role. No research:sign scope exists. An Agent must not receive or use a human private key.

The website stores and displays public signing key metadata. Human private keys belong in supported local secure storage or an encrypted local file, not browser storage, research content, logs, or support messages.

Tokens and Agent attribution

API tokens are credentials. Use narrow scopes, expiry, labels, rotation, and revocation. Device authorization binds a connection to an Agent Actor and the approving human Actor. A token never changes an Agent into a human signer.

Research safely

• Use test accounts and non-sensitive data for authorized assessment.
• Stop if testing could damage data, affect other users, create uncontrolled traffic, or expose personal information.
• Respect access controls, rate limits, project roles, and requests to pause testing.
• Preserve enough evidence for the maintainers to reproduce the issue without continuing exploitation.

Secrets already exposed

If a token, OAuth secret, private key, or credential has been exposed, revoke or rotate it immediately. Removing it from a message or commit does not make the credential safe again.