Security and vulnerability reporting

CyberBoar is a security control. If an agent can do something that the policy forbids through a construct CyberBoar claims to handle, we want to hear about it.

Report a vulnerability

Email security@cyberboar.io. Please do not disclose vulnerabilities in public issues, discussions, or pull requests. Where enabled, the core repository’s private vulnerability reporting is another way to contact the maintainers.

You do not need a complete exploit to report a concern. A command that cyberboar explain allows when the policy should deny it is enough to start.

Include, where available:

• The CyberBoar commit or version, agent and version, and operating system.
• The relevant policy and exact tool call or command line.
• Minimal reproduction steps, expected decision, and actual result.
• The potential impact and any workaround you have found.

Remove credentials, private keys, and personal or customer data from examples and logs. Test only systems you own or have permission to assess.

What to report

• Bypasses of supported file, command, or MCP-tool policy checks.
• Crashes, timeouts, or malformed input that cause a decision to fail open.
• Acceptance of unsigned or incorrectly signed policies or endpoint messages.
• Audit data sent somewhere other than the enrolled console, or unauthorized access to an enrolled endpoint’s key.
• Tampering with release signatures, checksums, or SBOMs.

The commercial console is covered by the same reporting address.

Documented limits and ordinary bugs

CyberBoar does not prevent a user from disabling their own hook or enforce every action of programs an agent launches. Review the security model and capability matrix before testing. Reports showing a practical attack or a limit broader than documented are still welcome.

For ordinary bugs, documentation fixes, and setup questions, use the core repository rather than the security mailbox.

Response and disclosure

We aim to acknowledge reports within three working days and fix confirmed bypasses before disclosure. Reporter credit is given unless you ask otherwise. Please coordinate public disclosure with the maintainers so users can receive a fix or mitigation first.

Supported versions

Report against the latest published release or the current main branch. Include the exact version or commit so we can reproduce the issue.

This page follows the core repository’s security policy, which is the source of truth for reporting scope and supported versions.