agent-radar
2ed3415fb7
Publish Claude Code Binaries / Stage and publish binaries (push) Canceled after 0s
Publish Tutti App Runtime / Build darwin-arm64 (push) Canceled after 0s
Publish Tutti App Runtime / Build darwin-amd64 (push) Canceled after 0s
Publish Tutti App Runtime / Build linux-amd64 (push) Canceled after 0s
Publish Tutti App Runtime / Build windows-amd64 (push) Canceled after 0s
Sync Tutti Agent Skills / sync (push) Canceled after 0s
Windows Agent Adapters / Test Windows agent adapters (push) Canceled after 0s
Windows Daemon Adapters / Test Windows daemon adapters (push) Canceled after 0s
Publish Tutti App Runtime / Publish runtime catalog (push) Canceled after 0s
51 lines
1.7 KiB
Markdown
51 lines
1.7 KiB
Markdown
# Security Policy
|
|
|
|
Thank you for helping keep Tutti safe.
|
|
|
|
## Supported Versions
|
|
|
|
Tutti is in early development. Security fixes are made on the active `main`
|
|
branch and included in the next available release.
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
Do not open a public issue for security vulnerabilities.
|
|
|
|
Email `tutti@nexight.io` with:
|
|
|
|
- A clear description of the issue and impact.
|
|
- Steps to reproduce, proof-of-concept code, logs, or screenshots when available.
|
|
- The affected version, commit, operating system, and relevant configuration.
|
|
- Whether the issue affects Tutti Local, Tutti · VM, or both.
|
|
|
|
We aim to acknowledge reports within 3 business days. After triage, we will keep
|
|
you informed about severity, expected fix timing, and disclosure coordination
|
|
when applicable.
|
|
|
|
## Scope
|
|
|
|
In scope:
|
|
|
|
- Vulnerabilities in the desktop app, local daemon, CLI, or published packages in
|
|
this repository.
|
|
- Issues that expose local files, credentials, agent session data, workspace
|
|
state, or app outputs without user intent.
|
|
- Privilege escalation, command execution, sandbox escape, or unsafe update paths.
|
|
|
|
Out of scope:
|
|
|
|
- Social engineering, physical attacks, or issues requiring compromised user
|
|
devices.
|
|
- Vulnerabilities in third-party model providers, plugins, apps, or services that
|
|
are not maintained by this repository.
|
|
- Denial-of-service reports without a practical security impact.
|
|
- Automated scanner output without a working exploit path.
|
|
|
|
## Safe Harbor
|
|
|
|
We will not pursue legal action for good-faith security research that:
|
|
|
|
- Avoids privacy violations, data destruction, and service disruption.
|
|
- Uses only the access needed to demonstrate the issue.
|
|
- Reports the issue privately and gives us a reasonable time to fix it.
|