If you discover a security vulnerability, please report it responsibly:

1. Do NOT open a public issue.
2. Email security@swarming.world with:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
3. You will receive a response within 48 hours.
4. We will work with you to understand, fix, and disclose the issue responsibly.

This policy covers:

• The @web3viz/* npm packages
• The swarming.world web application
• The agent executor server

We appreciate security researchers who help keep swarming.world safe. Reporters will be credited in the security advisory (unless they prefer to remain anonymous).