ASC sits on a boundary that matters: it holds the approval and execution gates for the external mutations it manages, installs a skill bundle and a SessionStart hook into your Claude Code configuration, and reads SCM credentials from your environment. A defect here can let a managed act go out without its grant, or can leak a token into a log.

What ASC does not claim: it does not sandbox the same-OS-user shell. A raw command typed at that shell is outside ASC's enforcement boundary — that boundary belongs to the Host and the operating system. (0.8.x shipped a PreToolUse hook that pattern-matched shell commands; 0.9.0 retired it because it was not a security boundary and read as one.)

Reports are welcome, including ones that turn out to be nothing.

ASC is pre-1.0 and the packages ship in lockstep. Fixes land as the next release on the current line; there is no long-term support branch. Check what is latest with npm view @asc-agent/runtime version, and what you are running with asc --version.

Open a report through GitHub private vulnerability reporting on this repository (Security → Report a vulnerability). That keeps the details out of public view while it is being fixed.

If private reporting is not available to you, open a normal issue that says only that you have a security report and how to reach you — do not put the details in it. We will find a private channel from there.

There is no dedicated security mailing address. This document will not invent one: sending a report to an address nobody reads is worse than not sending it.

• API tokens, passwords, session cookies, or any other credential — not even expired ones
• Private repository contents, or private Jira / GitLab / Mattermost data
• Customer or employer data of any kind
• Full paths that identify you or your organisation, when a redacted path would do

If reproducing the issue genuinely requires a credential, say so and we will work out how to reproduce it without one.

• ASC version (asc --version)
• Operating system and Node version (node --version)
• Which package: @asc-agent/runtime or @asc-agent/bootstrap
• Reproduction steps with sanitised data — a fake token like ghp_EXAMPLE is fine
• What you expected, and what happened instead

• An ASC-managed external mutation (asc grant run, asc work publish) executing without a READY grant, executing more than once per grant, or executing after the pre-execution review found drift
• A remote freeze that the managed executor does not honour
• A credential appearing in a file ASC writes, in its output, or in a log
• ASC writing outside the boundaries it declares: a repository under local scope, a file outside a session's write boundary, or a user file the host installer does not own
• An install or update path that overwrites something a person edited without --force
• Anything that lets a plan apply a change it did not list

• A prerequisite being absent — for example claude not on PATH, or a missing token. ASC reports these as blocked, and that is the intended behaviour.
• An agent making a poor decision inside a boundary it was correctly granted. ASC bounds authority; it does not judge taste.
• A raw shell command (git push, glab api, curl) bypassing ASC. ASC never held that boundary; the Host's permission layer and the OS do.
• Requiring a human decision. Stopping at a boundary is the product working.

This policy covers the @asc-agent/runtime and @asc-agent/bootstrap packages and this repository. It does not cover Claude Code, npm, or any SCM provider — report those to their own maintainers.