Please do not open a public GitHub issue for security vulnerabilities.

Instead, email security@agents-md-linter.dev (or open a GitHub Security Advisory).

Include:

• A description of the vulnerability.
• Steps to reproduce.
• Potential impact.

We will acknowledge your report within 48 hours and aim to release a fix within 14 days for confirmed issues.

agents-md-linter is designed with security in mind:

• No secret reading. The tool only detects the presence of files such as .env, .env.example, *.pem, etc. It never reads or outputs their contents.
• No network access. All analysis is performed locally. No data is sent to any external service.
• No LLM calls. The tool is fully deterministic and offline.
• Read-only by default. The audit and print commands never write to disk. Only init and fix write files, and only after explicit confirmation.
• Minimal dependencies. We keep the dependency surface small to reduce supply-chain risk.