We take security vulnerabilities seriously. If you discover a security issue, please report it responsibly.

DO NOT create a public GitHub issue for security vulnerabilities.

Report security vulnerabilities through one of:

• GitHub Security Advisories: Create a private advisory
• Email: Contact the maintainer directly via GitHub

• Type of vulnerability (e.g., XSS, injection, authentication bypass)
• Full path to the affected file(s)
• Step-by-step instructions to reproduce
• Proof-of-concept or exploit code (if possible)
• Impact assessment

We will credit you in the release notes unless you prefer anonymity.

NEVER share your private key or commit it to version control.

# Use environment variables
export PRIVATE_KEY="your_key_here"

# Or use a .env file (ensure it's in .gitignore)
echo "PRIVATE_KEY=your_key_here" >> .env

1. Use a dedicated wallet for AI agent operations with limited funds
2. Start with testnets to verify behavior before using mainnet
3. Monitor transactions regularly for unexpected activity
4. Revoke approvals you no longer need using the built-in revoke tools
5. Set spending limits where possible

• Store API keys in environment variables, never in code
• Use separate keys for development and production
• Rotate keys periodically
• Monitor API usage for anomalies

Agenti can sign and broadcast transactions when provided with a private key. Users should understand:

• AI agents can initiate real transactions with real financial consequences
• Use wallets with limited funds appropriate to your use case
• Consider hardware wallet integration for high-value operations
• Review the x402 payment configuration to set appropriate spending limits

• All blockchain data queried is publicly available on-chain
• Be cautious about logging sensitive data in your application
• Review tool outputs before sharing in public contexts

• Dependencies are monitored via Dependabot for known vulnerabilities
• Lock files are committed to ensure reproducible builds
• Critical dependencies are pinned to specific versions

This project has not yet undergone a formal security audit. Use at your own risk. The x402 payment protocol dependencies (@x402/core, @x402/evm, @x402/svm) are maintained by their respective teams.

Always use the latest version to receive security patches:

npx @nirholas/agenti@latest

Subscribe to GitHub releases for security update notifications.