Security fixes are applied to the latest release.

Please use GitHub's private vulnerability reporting for this repository. Do not open a public issue containing secrets, exploit details, or private repository content. Include the affected version, a minimal reproduction, and the expected impact. You should receive an acknowledgement within seven days.

AgentWhy reads local instruction files. It never sends their contents over the network. HTML output escapes repository-controlled text and contains no remote scripts, fonts, or stylesheets.