If you discover a security vulnerability in Bunny Agent, please report it privately.

Do NOT open a public issue.

Send an email to: security@vikadata.com

Include the following information:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Any proof-of-concept code (if available)

1. You will receive an acknowledgment within 48 hours
2. We will investigate the vulnerability
3. We will work on a fix
4. You will be notified when the fix is released
5. We will credit you in the release notes (if desired)

Security fixes are backported to the latest supported version.

When using Bunny Agent:

• Never commit API keys to version control
• Use environment variables for sensitive data
• Rotate API keys regularly
• Use different keys for development and production

• Always use sandboxes in production environments
• Limit sandbox permissions to minimum required
• Regularly update sandbox images
• Monitor sandbox resource usage

• Keep dependencies updated: pnpm update
• Review dependencies for known vulnerabilities: npm audit
• Use official packages from npm

• Enable HTTPS for all endpoints
• Implement rate limiting on API endpoints
• Validate and sanitize all user inputs
• Log security-relevant events for monitoring

Bunny Agent uses sandboxed environments for code execution:

• Local mode: Runs on your local filesystem with your permissions
• Cloud mode: Runs in isolated containers (E2B, Sandock, Daytona)

For production use, always prefer cloud sandboxes for isolation.

• Review agent-generated code before deployment
• Validate file paths and operations
• Implement output filtering for sensitive data

Agents may access files within their working directory:

• Set appropriate working directory boundaries
• Audit templates for file access patterns
• Use volume mounts with care in cloud sandboxes

We will announce security updates through:

• GitHub Security Advisories
• Release notes for affected versions
• Email to security@vikadata.com subscribers

For security-related questions:

• Email: security@vikadata.com
• GitHub: https://github.com/vikadata/bunny-agent/security