Please do not report security issues through public GitHub issues, discussions or pull requests.

Email responsible-disclosure@indykite.com instead. The full policy, including what is in and out of scope, what to include in a report, response times and safe harbor, is in responsible_disclosure.md.

If private vulnerability reporting is enabled on this repository, you may also use the "Report a vulnerability" button under the Security tab.

Security fixes are made on the master branch and shipped in the next release. Only the latest release is supported; please reproduce against it before reporting.

This repository covers the Intent Agent service only. For vulnerabilities in the IndyKite platform or any other IndyKite product, use the same address; the team routes the report.