| Version | Supported |
|---|---|
| 0.7.x | ✅ Current release |
| < 0.7 | ❌ No patches |
Please do not report security vulnerabilities through public GitHub issues.
Instead, report them via email:
Please include:
- A description of the vulnerability
- Steps to reproduce the issue
- Affected version(s)
- Any potential impact you've identified
- Acknowledgement: Within 48 hours of report
- Initial assessment: Within 7 days
- Fix target: Within 30 days for confirmed vulnerabilities
- Public disclosure: After a fix is available, coordinated with the reporter
agentplan is a local CLI tool that stores data in a SQLite database. The primary security concerns are:
- Command injection via agent command templates (
{ticket},{prompt}placeholders) - Path traversal in project directory configuration
- SQL injection in CLI inputs
- Pin agentplan to a specific version in production workflows
- Review agent command templates before use — they execute shell commands
- Use the
--dry-runflag to preview operations before committing changes