# Security reporting | AgentClash

How to report a vulnerability privately and where to read about sandbox and secrets configuration.

Source: https://www.agentclash.dev/security
Markdown export: https://www.agentclash.dev/md/security

## Report a vulnerability

Use GitHub private vulnerability reporting from the repository Security tab. Do not report vulnerabilities in public issues, discussions, or pull requests. Include the issue and impact, reproduction steps, affected component and version or commit, and relevant configuration.

- [Repository security policy](https://github.com/agentclash/agentclash/security/policy)

## Response and supported versions

The project aims to acknowledge reports within a few business days. Please allow a reasonable window for a fix before public disclosure and mention if you would like credit. Fixes target the latest main and the most recent release.


## Explore the security documentation

The security policy identifies sandbox escape, credential exposure, tenant isolation, authorization bypass, and injection as areas of interest. Consult the configuration documentation for the boundaries of your deployment.

- [Sandbox and E2B](https://www.agentclash.dev/docs/challenge-packs/sandbox-and-e2b)
- [Tools, network and secrets](https://www.agentclash.dev/docs/concepts/tools-network-and-secrets)
- [Security evaluation](https://www.agentclash.dev/docs/guides/security-evaluation)