This project's security claim is narrow and stated in full in docs/threat-model.md:

An agent that is confused, hallucinating or prompt-injected cannot cause unauthorized spend.

Reports that bear on that claim are in scope. Explicitly out of scope, and documented as such: compromise of the server process itself, a malicious operator, phishing the human who approves, and supply-chain attacks on dependencies.

Open a private security advisory on GitHub. Please do not open a public issue first.

Useful reports include a reproduction — ideally a failing test. The adversarial corpus in src/safety/corpus.ts is the natural place for an injection payload, and a payload that gets past the detectors is worth reporting even if it does not lead to spend.

Expect an acknowledgement within a few days. This is a personal open-source project, not a funded security team, and response times reflect that.

• A path to place_order without a valid authorization.
• An approval that can be forged, replayed, or applied to a cart other than the one it was granted for.
• Merchant-controlled data reaching a position where it is treated as an instruction or as a policy input.
• A policy rule that can be bypassed through tool argument manipulation.
• Payment credentials or signing keys reachable from the agent's context.

• An injection payload that the detectors miss but that cannot move money. That is expected behaviour, documented in docs/adr/0004 — still, please send it, it belongs in the corpus.
• Anything requiring code execution on the server.
• Denial of service against a local process.