agent_blueprint_protocol

# Security policy

## Supported versions

| Version | Supported |
| --- | --- |
| 0.8.x | yes |
| 0.7.x | no — upgrade to the current line |
| 0.6.x | no — upgrade to the current line |
| 0.5.x | no — upgrade to the current line |
| 0.4.x | no — upgrade to the current line |
| 0.3.x | no — upgrade to the current line |
| 0.2.x | no — upgrade to the current line |
| 0.1.x | no — upgrade to the current line |

## Reporting a vulnerability

Report privately through GitHub: open the repository's
[Security tab](https://github.com/baselabs/agent_blueprint_protocol/security)
and choose **Report a vulnerability**
([direct link](https://github.com/baselabs/agent_blueprint_protocol/security/advisories/new)).
Do not open a public issue containing an exploit, credential, private key,
production data, tenant data, or unreleased vulnerability detail.

A report should identify the affected commit or package version, the violated
protocol property, a minimal value-free reproduction, and the expected
fail-closed result.

## Security boundary

This package validates structural protocol facts. It does not discover trust,
hold keys, issue or revoke grants, evaluate live authorization, reserve replay,
execute tools, own effects, or decide product policy. Consuming hosts
must treat every successful result as non-authorizing evidence.