Security fixes ship in new releases on GitHub and npm. Pin to a current release when possible.

Do not open a public GitHub issue for security reports.

Use GitHub Security Advisories for private disclosure.

Include:

• Affected version and install path (npm global, monorepo, Codelink plugin bundle)
• Impact (secret exposure, remote code execution, unauthorized local network access, etc.)
• Reproduction steps or a minimal PoC
• Whether the issue is already public

We will confirm when a fix is released and credit reporters who want attribution (unless you prefer anonymity).

Agent Deck is a local product:

• The MCP daemon binds to 127.0.0.1 only (default ports: MCP 1110, OAuth callback 1111, dashboard as configured). It is not intended as a public internet service.
• API keys and secrets are stored in the OS keychain / local vault, not in the repo or the Codex/Claude plugin bundle.
• The marketplace plugin bundle (.codex-plugin/, skills/, .mcp.json) points at the local HTTP MCP URL; the daemon must already be running (agent-deck setup / agent-deck start). Skills are thin protocol stubs — they do not mirror playbook bodies or embed credentials.

Out of scope for this policy: third-party MCP servers registered on a deck, host IDEs (Codex, Claude Code, Cursor), and Hol/Hashgraph Online marketplace infrastructure.

• No hardcoded secrets in source, fixtures that look like live tokens, or CI workflows with write-all without justification
• Prefer SHA-pinned GitHub Actions
• Dangerous shell patterns in skills or MCP command entries will fail marketplace scanners — keep skills read-only guidance and let the user run install commands