Found a sensitive security issue in the Agent Kaizen harness? Report it privately through GitHub private vulnerability reporting. Open the repository's Security tab and choose Report a vulnerability. This keeps the report private until a fix is ready.

For a non-sensitive bug with no exploit risk, a normal public issue is fine and gets triaged faster. There is no security email; please use the private advisory form instead.

Include:

• what you observed and why it is a security problem;
• the exact command or steps to reproduce;
• the commit you are on (git rev-parse --short HEAD) and your OS + Python version.

In scope: the harness code in this repository, namely kaizen.py, kaizen_components/, test and acceptance infrastructure under tests/, and setup/installer scripts under setup/.

Out of scope:

• Your data and chosen external services. Project records default to the local database (db/). Explicitly configured model, ComfyUI, vendor-agent, fleet sync/control, and Git-remote features may send operation-specific data to services or endpoints you select; setup may also download dependencies (see the FAQ). Those services' own handling is out of scope, but a harness bug that transmits more than the selected operation or configuration requires is in scope.
• Third-party dependencies: report those upstream. On pushes to main and pull requests, the CI audit job runs pip-audit against the core, docs, and optional PyTorch requirements.

• .github/secret_scanning.yml: GitHub secret scanning is enabled; it excludes only tests/test_redaction.py, which holds secret-shaped fixtures used to prove the redaction gate denies them.
• kaizen_components/redaction.py: file and record write paths run through a redaction gate that denies secret-shaped strings before they land.

Treat the configured external skill store as trusted, operator-controlled instruction and code input. No Kaizen leaf places a package's SKILL.md prose into model context; a host reads a linked skill through its own folder link, and containment, validation, live package hashes, and a correct selected-host surface cannot make untrusted instructions safe. Claude project policy has a supported four-state writer; Codex policy is currently audit-only/default-on because no supported project-local writer exists. A published label means only that a configured package Git remote validates as GitHub; staged means it does not. Publication state is neither a trust decision nor an activation decision, and a staged package is not automatically disabled. Skill inventory reads and checks do not fetch or publish repositories, install links, change host policy, enable skills, or execute package scripts.