Please do not open public issues for security problems.

Report a vulnerability privately with GitHub's Report a vulnerability button on the Security tab of this repository.

What to include: the affected component (plugin, skill, CLI), the version or commit, and steps to reproduce. Do not include a live API key; revoke any key you have exposed in the console at https://sbx.agent-next.com/console.

We acknowledge reports within 72 hours and triage within 7 days. We ask for a reasonable window for coordinated disclosure so users can upgrade first.

Scope: the contents of this repository. For the hosted sandbox service itself, use the same private report channel.