A Chinese version is available at SECURITY.zh-CN.md.

Metis is on 0.x. Security fixes are provided for the latest published release only. The current release line is 0.4.x; users on that line should run its latest available release.

Do not open a public GitHub issue for security problems.

Use GitHub's private vulnerability reporting form. The report should include:

• A description of the issue
• Steps to reproduce (PoC code or commands welcome)
• Affected versions
• Any known mitigations

You should expect:

• An acknowledgement within 5 business days
• A fix or status update within 30 days for confirmed issues
• Coordinated disclosure: we will agree on a release date before any details are made public, and credit the reporter unless they prefer anonymity

In scope (we want to know):

• Sandbox / permission-gate bypass: a tool call running outside what the permission mode advertised
• Path traversal in Read / Edit / Glob / LS
• Command injection in Bash policy
• Plugin or MCP-server escalation that lets a third-party server read credentials, system files, or other plugins' state
• Memory store leaking secrets across users / sessions on a shared host

Out of scope (please don't report):

• The user voluntarily setting --mode fullAccess (or --dangerously-bypass-approvals-and-sandbox) and allowing a command to run with the host account's access — that mode explicitly disables approvals and the process sandbox
• Issues in upstream LLM provider APIs
• Denial of service via giant inputs (Metis is a local CLI; use ulimit)
• Sensitive data the user themselves wrote to a config file in plain text

• Never pass real API keys via the api_key = "..." field in config.toml. Use api_key_env = "ANTHROPIC_API_KEY" and keep the secret out of the file.
• Default to mode = "default" until you've reviewed which tools you trust to auto-run.
• Treat ~/.metis/ as you would treat ~/.ssh/ — same filesystem permissions, no checking it into a shared dotfiles repo.