If the report is about a way to get code or data past a boundary abx claims to hold, report it privately. Use Report a vulnerability in the Security tab. That opens a private advisory only maintainers can read, and it keeps a working exploit off a public page until there is something to upgrade to.

Everything else belongs in a normal issue. A crash, a wrong refusal, a confusing message, a dependency alert — none of those get worse for being public, and a public issue is easier for everyone.

If you are not sure which it is, use the private route. Being wrong that way costs nothing.

Expect a slow reply. This is a single-maintainer project with no on-call and no service commitment.

abx makes a small number of promises. A defect matters in proportion to which one it breaks.

The audited return path. abx pull, abx review and abx merge inspect what comes back before it reaches your repository, and refuse rather than warn. Anything that gets an exec-capable git configuration, a hook, or a .gitattributes filter past that audit and onto the host is the most serious class of bug this project has. The threat is concrete: core.fsmonitor runs on a bare git status, on your machine, while you are reviewing what an agent did — see CVE-2026-55607 and CVE-2026-45033.

A read-only box returns no file, ever. pull, review, merge and cp all refuse for such a box's whole life. A way to extract a file from one is a vulnerability even if nothing sensitive was in it.

No credential is inside a box. The gateway holds the secret and substitutes it at the proxy, per binary. A way to read a real credential from inside a box, or to reach an endpoint the profile did not grant, is a vulnerability.

Prompt injection is in scope where it crosses a boundary, and out of scope where it does not. An agent inside a box being talked into doing something inside that box is expected and is what the box is for. The same agent getting a file, a credential or an execution onto the host is the bug.

The answer from abx ask being wrong or manipulative. abx audits the container an answer arrives in — encoding, size, what the box could reach — never the text. This is stated in abx --help and in docs/adr/0003. Treat an answer as data.

A subscription box spending your quota. It spends the same quota as the session that dispatched it. There is no technical mitigation, and abx says so rather than hiding it.

Anything downstream of a credential you attached on purpose. --cred grants what the profile grants. If a profile is wider than you meant, narrow the profile.

OpenShell's own behaviour. abx is a wrapper. Report those to NVIDIA/OpenShell; if the wrapper could have refused something dangerous and did not, that part is ours.

The latest release. This project is pre-1.0 and there are no backports.

Every release publishes a checksums.txt, and scripts/install.sh refuses to install an archive that does not match it. Archives are signed with cosign (keyless, so the signing identity is the release workflow itself) and carry GitHub build provenance:

gh attestation verify abx --repo gustavopiltcher/agentbox

cosign verify-blob \
  --bundle checksums.txt.sigstore \
  --certificate-identity-regexp 'https://github\.com/gustavopiltcher/agentbox/\.github/workflows/release\.yml@.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  checksums.txt