Relayfile is part of Agent Relay. It handles credentials, tokens and agent session data, so we treat security reports as a priority over feature work.

Please report vulnerabilities privately. Do not open a public issue, pull request or discussion for a security problem.

• Email (preferred): [email protected]
• GitHub private vulnerability reporting, once it is enabled for this repository: https://github.com/AgentWorkforce/relayfile/security/advisories/new

Please include:

• the affected component, version, image digest or commit;
• the type of issue (for example authentication bypass, credential disclosure, injection, privilege escalation, or denial of service);
• steps to reproduce, ideally a minimal configuration or script;
• the impact: what an attacker gains and what access they need to start.

Redact credentials before you send them. Replace tokens, API keys and connection strings with placeholders. If a report needs a live credential to demonstrate, tell us and we will arrange a private channel for it.

• Acknowledgement: within 3 business days.
• Assessment: we aim to confirm or dispute the report, with a severity assessment, within 10 business days.
• Updates: we will tell you how remediation is going, and if a fix will take longer than expected.
• Disclosure: we publish an advisory once a fixed release is available and credit you by name or handle unless you prefer otherwise.

Please give us a reasonable opportunity to ship a fix before you disclose publicly. We do not run a paid bug bounty.

Each artifact (binaries, npm packages, Python package, container images) is versioned on its own. A fix ships in the next version of each affected artifact; we do not backport fixes to older versions, so upgrade that artifact to its latest version to receive them.

In scope: the code in this repository and the artifacts built from it (the relayfile binaries, npm and Python packages, and the relayfile and relayfile-actors container images).

Out of scope: vulnerabilities in third-party dependencies with no demonstrated exploit path through this project, findings that need an attacker to already control the host or cluster running the service, and unvalidated reports from automated scanners.