Please report security issues privately through GitHub's private vulnerability reporting on this repository, rather than opening a public issue.

Include what you did, what happened, and what you expected. A proof of concept helps a lot. Expect a first reply within a week.

agmon is a local developer tool. The backend binds to 127.0.0.1 only and has no authentication by design: anything already running as your user can talk to it, the same way it could read your process table directly.

What is still in scope:

• Anything reachable from outside the loopback interface, including requests a web page can make to localhost (the WebSocket handshake ignores the same-origin policy, and DNS rebinding can turn a hostile hostname into a same-origin request). agmon validates the Origin and Host headers on both the HTTP server and the WebSocket upgrade for this reason.
• Untrusted input reaching the backend or the UI: command lines of arbitrary processes, log file contents, file names under the logs directory, and hook payloads posted to /api/events.
• Reading or writing files outside the logs directory.
• The wrappers and installers corrupting or destroying user files ($PROFILE, .bashrc, .zshrc, ~/.claude/settings.json).

What is out of scope:

• The lack of authentication on the loopback port.
• Another process on the same machine impersonating an agent by naming itself after one, or by writing files into the logs directory.