Report a suspected vulnerability privately through GitHub security advisories: open the Security tab of github.com/thingctx/thingagent and choose "Report a vulnerability". Do not open a public issue. We aim to answer within a few business days.

Read the Limits section of the README and docs/LIMITS.md first. They list what thingagent does not defend today, such as a broker that does not bind each login to its name and a policy check that shares a process with the model when no broker is used. A report about one of those limits is still welcome when it shows a way around the stated defense.