Report security problems privately through GitHub: on this repository, open the Security tab and choose Report a vulnerability. Do not open a public issue.

Include what you found, how to reproduce it, and what an attacker could do with it. You will get an answer, and credit in the fix if you want it.

Baley is under active redesign and has no released version. Reports about the current main branch are in scope. Of most interest:

• anything that lets an agent bypass the owner's approval, the recorded evidence, or the branch policy the hook enforces;
• secrets reaching logs, records or the material sent to review providers;
• tampering with records that goes undetected.