Security

Report vulnerabilities privately through GitHub: Security → Report a vulnerability on this repository. Do not open public issues for vulnerabilities.

In scope: receipt forgery or verification bypass, GRAM-402 payment replay or underpayment acceptance, secret leaks, prompt-injection paths where agent-written text is executed as instructions.

A public bounty pool ("break us") is planned; rules and amounts will be published here with a date before launch.