Responsible disclosure
Report a security vulnerability
Found a security issue in Agent Abilities? Report it privately so it can be fixed before it is public. Here is how, and what to expect back.
Report it privately through GitHub
The primary channel is GitHub Security Advisories on the plugin repository. It keeps the report private between you and the maintainer until a fix is ready, and it never exposes the details in a public issue.
Please do not open a public issue or a pull request for a security problem, and please do not post the details anywhere public until a fix has shipped.
What to include
The more of this you can give us, the faster the issue can be confirmed and fixed:
- The plugin version, plus your WordPress and PHP versions.
- A clear description of the issue and its impact if abused.
- Steps to reproduce, and a minimal proof of concept if you have one.
- Any relevant configuration, such as which abilities were enabled or how the connection was authenticated.
What to expect
Reports are reviewed and acknowledged. Once an issue is confirmed, a fix is prepared and released, and the advisory is published so other users can update. If you would like credit for the report, say so, and you will be credited in the advisory. This is an open-source project with no paid bug bounty, so there is no monetary reward, but well-reported issues are genuinely appreciated.
Built to limit the blast radius
The plugin is governed by design: nothing is exposed until you enable it, the agent connects as a real least-privilege user rather than an admin key, every ability re-checks its capability before it runs, and every call, denials included, is written to a log in your own database. The plugin also makes no outbound calls of its own. That posture is meant to keep the impact of any single issue small, and clear reports help keep it that way. You can read the source on GitHub.
Security is the whole point.
The plugin exists to put AI agents on a leash you hold. If you find a gap in that, telling us privately is the most useful thing you can do.