Security policy. Tell us what you find.
Report security problems to security@agenttasklock.com. We reply within 3 business days.
We want to hear about security problems in Agent Task Lock.
We will not take legal action against people who look for them in good faith and follow this page.
Report to: security@agenttasklock.com.
Please include:
- what you found
- the version (Settings › About, or
tmj --version) - the steps to reproduce it
- what you think an attacker could do with it
Encrypted mail is welcome; ask for a key in your first message.
What is in scope
- The Mac app (both the Tauri build and the native shell) and the engine (
tool/,tmj). - The iPhone app and its pairing and approval protocol (
docs/PHONE.md). - The browser add-on (the Chrome build) and its native host.
- The record: anything that lets a change slip past the record check, or lets someone fake an approval.
- Limits: anything that lets an AI tool reach a folder set to Closed to AI. Or that lets a job land without a decision, or skip a second review.
- The trust documents, if what they say does not match what the code does.
What is out of scope
- The AI tools themselves (Claude Code, Codex, Cursor, Gemini CLI, Copilot CLI) and AI websites.
- Problems that need someone who already has administrator rights on the Mac or PC. Those are real limits and are written down in
GUARANTEES.md; reports that show a new one are still welcome. - The sales website, unless the problem affects people who visit it.
- Floods of traffic at the phone server on the local network. Also tricking people, and attacks in person.
Safe harbor
Act in good faith and stay within the scope above. Do not access or keep other people's data, and do not harm anyone's systems.
Give us a fair time to fix the problem before you tell others.
If you do all that, we will not bring or support legal action against you for your research. We will say so if anyone asks.
What happens next
- We reply within 3 business days to say we have it.
- We tell you whether we can reproduce it and what we plan to do within 10 business days.
- We aim to ship a fix for serious problems within 30 days. We will thank you by name in the change list, if you want to be named.
- We publish what was found and fixed once a fix is out.
Agent Task Lock is built and supported by a very small team today; these times are goals, not a service level backed by a contract.
Enterprise customers get the times in their agreement.