Please do not open a public issue for security problems.

Report privately through GitHub's private vulnerability reporting for this repository: https://github.com/fujibee/agmsg/security/advisories/new

Include what you found, how to reproduce it, and which version or commit you tested. We aim to acknowledge reports within 7 days, on a best-effort basis. Accepted fixes are released before the advisory is published.

Only the latest release on the main branch receives security fixes.

agmsg is a local tool. It stores team messages on the user's machine, either in a SQLite file (the default) or in an append-only JSONL event log (an opt-in storage driver) — either way, the store stays local unless remote sync is explicitly configured. It runs adapters (ext-tool) on the sender's machine. The built-in secret command stores ext-tool credentials in files with 600 permissions and never echoes the value; bundled adapters are designed not to print it to chat, message history, or logs. Reports about any of these paths are welcome, as are reports about the optional remote sync.