AgentRail is a control plane for agents — it sits between them and the tools they call. That makes its own security posture load-bearing.

Do not open a public issue. Email the maintainers directly or use GitHub's private vulnerability reporting (Security → Report a vulnerability). Include:

• the component and version affected
• a minimal reproduction (agent setup, policy, tool call)
• the observed and expected behaviour

In scope: the daemon, the SDK's daemon communication, the grpc-web bridge, and the approval flow. Out of scope: LLM behaviour itself — AgentRail cannot (and does not claim to) fix a model that is instructed to do something harmful. It limits blast radius.

• Fail-closed: store down ⇒ daemon refuses checks. No audit trail ⇒ no execution.
• Socket hygiene: the Unix socket is created mode 0600; nothing else on the host can reach it.
• No daemon auth: the daemon has no authentication of its own. Do not expose it beyond the trusted network boundary (see docs/daemon-deployment.md).
• Approval default deny: a timed-out approval resolves to deny in production configs.

Security fixes land on the latest release. Older releases receive fixes for critical issues for 90 days after a successor is published.