We actively investigate and patch security issues in the current AgentSociety 2 release line:
| Component | Source | Actively maintained |
|---|---|---|
agentsociety2 (Python) |
packages/agentsociety2/ |
Yes |
| VS Code extension | extension/ |
Yes |
| Web frontend | frontend/ |
Yes |
agentsociety v1.x |
packages/agentsociety/ |
Legacy — best-effort only |
agentsociety-community |
packages/agentsociety-community/ |
Legacy — not in active CI scope |
agentsociety-benchmark |
packages/agentsociety-benchmark/ |
Legacy — not in active CI scope |
Upgrade to the latest PyPI release before reporting an issue.
Security scanning (CodeQL, Dependabot, CI audits) is scoped to AgentSociety 2 paths. See .github/agentsociety2-scope.yml.
Do not open a public GitHub issue for exploitable vulnerabilities or exposed credentials.
Report privately with:
- Description and impact
- Steps to reproduce (PoC if possible)
- Affected component, version, or commit hash
- Suggested fix or mitigation (optional)
Contact
- Email: agentsociety.fiblab2025@gmail.com
- For non-sensitive hardening suggestions, you may use the Security issue template on GitHub
We will acknowledge receipt, investigate, and coordinate a fix and release. We aim to provide an initial response within a reasonable timeframe.
- Never commit API keys, tokens, or
.envfiles - Run
pre-commithooks (detect-private-keyis enabled) - Extension
.envwrites escape sensitive values; do not log API keys - Backend path helpers reject
..and null bytes in user-supplied paths