Do not report security issues in a public GitHub issue, and do not include real credentials, endpoints, prompts, or customer data anywhere in a report.

Use GitHub's private security advisory form for this repository. If that form is unavailable, open a minimal public issue requesting a private contact channel without describing the vulnerability.

• Bind Redis to loopback only; do not expose TCP port 6379 to the public Internet.
• Use a VPN or SSH tunnel for remote collaborators.
• Do not put credentials or tokens in AGENT_BROADCAST_REDIS_URL, commands, commit history, or screenshots.
• Treat every broadcast message as collaboration metadata, not a secret store.
• Review installed commands with /hooks after every binary path or package update.
• Hooks publish fixed lifecycle messages, a hashed session label, and the final project directory name. They must never be changed to publish prompt, transcript_path, full cwd, tool_input, or tool results without an explicit security review.
• Redis events are allowlisted by coordination topic, product, session-token shape, and lifecycle message before they can become agent context.
• Hook failure is intentionally fail-open. Missing events are not evidence that no other session is active and do not replace file locks or human coordination.