The latest released version and main receive security fixes. This project is a local-first Hermes plugin, not a hosted service.

Please report vulnerabilities privately through GitHub's Security Advisories: open the repository's Security tab and choose Report a vulnerability. Do not open a public issue for a suspected vulnerability.

Include, as far as you can:

• affected version or commit, and the deployment mode (embedded / server / cloud),
• reproduction steps or a proof of concept,
• the impact you believe it has (data exposure, injection, denial of service),
• any suggested fix.

You can expect an initial response within a few days. Please allow time for a fix and a release before public disclosure. We credit you in the release notes unless you prefer otherwise.

In scope: the plugin package (qdrant_memory/), its CLI, and the documented Hermes integration in this repository. Examples: credential handling and scope leaks, prompt-injection paths through stored memory, unsafe defaults, or path and permission issues.

Out of scope are vulnerabilities in Hermes Agent itself, in Qdrant, in Ollama and in services you configure. Report Hermes Agent issues to NousResearch/hermes-agent. Report Qdrant issues through the Qdrant bug bounty program. Report Ollama issues through the Ollama security policy. Reports that require pre-existing local shell access or a compromised host are usually out of scope. This project does not run a bug bounty program.

• Keep credentials in Hermes's secret scope. Logs and issues must never contain API keys, tokens, or memory payloads.
• docs/security.md describes the deployment security boundaries of this plugin. It is operational guidance, not a disclosure policy.