Only the latest released minor version receives security fixes.

Do not open a public issue for a suspected vulnerability or a potentially exposed evidence bundle. Report it privately through the repository security advisory flow, including affected version, a minimal reproduction, impact, and any relevant redaction details. Maintainers should acknowledge reports within five business days and coordinate a fix before disclosure.

AgentAxiom is designed to redact evidence, but users remain responsible for configuring project-specific redaction patterns, access controls, retention, and regional storage policies. Never place production credentials in fixtures, prompts, contracts, or CI logs.