Last updated: 2026-07-12.

Universal Agent Runtime (UAR) is open-source software (MIT) developed by Prometheus AGS. We continue to treat ourselves as a manufacturer in the sense of the EU Cyber Resilience Act and operate this policy accordingly, because Prometheus AGS offers commercial services built on UAR — the relicense to MIT changed the software's terms, not our security obligations to the people running it.

Please do not open a public issue for security reports.

Report privately via GitHub private vulnerability reporting: Security → Report a vulnerability.

Include what you can: affected version/commit, reproduction steps, impact assessment, and any suggested fix. Reports are welcome in English.

These are operating targets, not contractual guarantees (commercial support contracts govern guarantees):

For vulnerabilities we assess as actively exploited, we align with EU CRA Article 14 reporting practice (24-hour early warning / 72-hour notification to the relevant CSIRT/ENISA channels, applicable from 2026-09-11).

The supported 1.0.x line covers the published server/archive artifacts and the Stable rows in the product support matrix. Preview and Experimental capabilities receive best-effort fixes unless a commercial agreement states otherwise.

• cargo audit, pnpm audit, and the GitHub Dependabot alert gate run as local release checks; GitHub Actions are reserved for deployment execution and deployment-specific validation. Any suppressed advisory must be disclosed with rationale in docs/DEPENDENCY_MANAGEMENT.md.
• Dependabot is enabled for Rust and npm ecosystems.

UAR ships secure-by-default: JWT auth required, rate limiting enabled, prompt-injection/PII guardrails active, secrets redacted from logs. See the deployment guide before changing these defaults.