# Security Policy

Agent Desktop Harness (ADH) controls real desktop applications and exposes a
trusted Python execution environment. Treat every ADH workflow as code running
with the permissions of the current user.

## Supported versions

ADH is currently alpha software. Security fixes are provided for the latest
published `0.x` release only. Older releases and development snapshots are not
supported. Users should upgrade before reporting an issue that has already been
fixed in the latest release.

## Reporting a vulnerability

Do not disclose a suspected vulnerability in a public issue, discussion, pull
request, RPA workspace, log, screenshot, or recording.

Report vulnerabilities through GitHub's private vulnerability reporting page:

https://github.com/xuyw1997/agent-desktop-harness/security/advisories/new

Include the affected ADH version and Windows build, the security boundary that
was crossed, minimal reproduction steps, impact, and any suggested mitigation.
Remove credentials, personal data, and unrelated application content. If a
proof of concept must manipulate the desktop, use disposable test accounts and
non-sensitive data.

We aim to acknowledge a report within three business days and provide an
initial assessment within seven business days. Remediation and disclosure timing
depend on severity and release complexity. Please allow a reasonable period for
a fix before public disclosure.

## Security model

- `run_python` provides trusted, full Python. It is not a sandbox and may use
  files, the network, subprocesses, imports, and other operating-system APIs
  available to the current user.
- Desktop actions are real side effects. A host agent is responsible for user
  confirmation before consequential actions such as sending content, making a
  purchase, changing permissions, entering secrets, or deleting data.
- ADH is intended for a local interactive user session. It must not grant a
  different user, session, or lower-integrity process access to the current
  user's daemon or desktop capabilities.
- ADH does not make untrusted RPA source, Python code, prompts, selectors, or
  downloaded files safe to execute. Review workflows and dependencies before
  running them.
- Logs, screenshots, source manifests, Robot Framework outputs, and other
  artifacts may reveal application state. Keep them out of public reports and
  repositories unless they have been reviewed and redacted.
- Do not weaken named-pipe ACLs, disable operating-system protections, or run
  ADH elevated to work around an access or integrity mismatch.

Examples of security issues include authorization bypasses, cross-user or
cross-session access, unintended privilege escalation, release or update
integrity failures, validation bypasses that cross a documented security
boundary, and unintended disclosure of credentials or sensitive artifact data.
Documented trusted-code behavior on its own is not a vulnerability.

## Release integrity

Use the official WinGet package or assets from the project's GitHub Releases.
Verify published SHA-256 checksums. Current alpha Windows binaries may be
unsigned; this limitation is identified in the release notes and package
metadata. Authenticode status can be inspected with standard Windows signature
tools. Never ignore an unexpected checksum or signature mismatch.

## Dependency vulnerabilities

If a report concerns a third-party dependency, identify the dependency,
affected version, advisory identifier, and whether ADH's actual configuration is
exploitable. Third-party license information is maintained in
`packaging/THIRD_PARTY_NOTICES.txt` and release SBOMs.