Agent HTML Render is currently in its 0.5.x development line. Security fixes go to the latest release only.

Please use GitHub private vulnerability reporting. Do not include an active Agent HTML Render review URL, daemon token, session file, or sensitive reviewed artifact in a public issue.

Include the affected version, operating system, reproduction steps, expected impact, and any suggested mitigation. We will acknowledge the report and coordinate disclosure with you.

The sandbox limits what agent-authored HTML can do, and the daemon listens only on the local machine. The security boundaries are:

• loopback-only HTTP transport;
• separate random secrets for agent and reviewer access;
• handle-pinned project-root containment for every artifact read;
• sandboxed artifact rendering with a restrictive CSP;
• bounded and runtime-validated messages and feedback, including an acknowledged keyboard-mode handoff and target traversal that leaves authored DOM focus metadata unchanged, rejects transparent, clipped, masked, covered, or persistently off-screen fragments, resolves pointer-transparent paint order through an isolated browser hit-test override rather than flattened z-index guesses, applies the same topmost visibility proof to trusted outlines, heading context, anchor recapture, and saved context, and never turns discontinuous hidden text into a trusted exact selection;
• context-encoded terminal output: filesystem and error values cannot create trusted CLI status or diagnostic records, structured JSON remains valid and exact, Unicode line separators cannot escape quoted Markdown artifact context, and artifact paths and stable identifiers remain exact;
• complete feedback output before acknowledgement, including large bounded JSON and Markdown batches under stdout backpressure; the authenticated wait endpoint requires the explicit-acknowledgement capability and exactly one valid caller-supplied consumer identity, and accepts at most one exact, bounded decimal safe-integer cursor, rejecting duplicate exact keys, structured bracket/dot aliases, NUL-tainted names, and oversized text before listener or lease allocation without conflating unrelated same-prefix names, and has no response-write auto-commit fallback; every shipped store lease operation independently enforces the same bounded consumer and grant grammar plus safe cursor and sequence inputs, uses only its internally validated clock, rejects caller-supplied timestamps or extra arguments, and proves TTL addition remains a safe integer, leaving no malformed-input reservation or credentialless commit path; output has a 120-second ceiling, every ephemeral delivery grant has an opaque ID that is renewed while writing, and each acknowledgement attempt plus the complete retry window is bounded inside the final renewed lease; renewal/acknowledgement/release serialize against that exact session/sequence/consumer/grant, an uncommitted acknowledgement must still hold an unexpired grant inside that boundary, and only a private digest of the committing grant is persisted for response-loss reconciliation after expiry; stale writers plus stale or expired acknowledgements and releases are inert, and an acknowledgement pins its grant through durable cursor publication; a closed reader leaves durable feedback queued while reporting whether bounded exact-grant release was confirmed, while renewal loss or the output deadline terminates a pending writer without early release so operating-system closure precedes later eligibility;
• private no-follow state files with single-link and mode checks plus pinned root/state/session directory identities across startup, authenticated health, atomic replacement, log maintenance, restore, and diagnostics; restore preflights aggregate file-count and byte budgets and uses bounded concurrency, while live commits and every ordered recovery-commit prefix serialize admission against the same limits, accounting advances at each rename commit, and post-commit boundary uncertainty permanently retires the store and daemon while preserving any acknowledgement pin and rejecting later lease issue/renew/release/acknowledgement operations; a Linux abstract-socket listener serializes startup without release-time pathname mutation, transfers only after a nonce-validated READY handshake, carries a per-start ownership identity and the pinned state identity into the child, stays held for the daemon lifetime, and must attest the same owner before daemon reuse; executable Node modules, the UI, and the bridge all participate in build compatibility; diagnostics expose mismatches without mutating them and leave legacy lock files as read-only blockers; shutdown proves process exit and endpoint closure before replacement; watcher callbacks retire immediately, in-flight persistence, mutating requests, and daemon-log maintenance drain before a clean close, one monotonic absolute stop deadline bounds the request, endpoint probes, and their composed cleanup while retaining final ownership observations, and the detached daemon keeps coordinator ownership until process exit when quiescence cannot be proven so old state work cannot overlap a successor;
• explicit separation of reviewer instructions from untrusted artifact excerpts.

Secure artifact reads currently require POSIX O_NOFOLLOW semantics, and collision-free startup coordination currently requires Linux abstract sockets. Other operating systems fail closed and are not part of the beta's release-gated compatibility envelope.

Agent HTML Render is not a security boundary against another local user or process that can read the project directory, process memory, or browser profile. Review URLs are bearer credentials for their local session and should be treated as sensitive.