We take the security of the Agent Messaging Protocol seriously. If you discover a security vulnerability, please report it responsibly.

Email: security@agentmessaging.org

GitHub: Open a security advisory

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

This policy covers:

• The Agent Messaging Protocol specification
• Reference implementations maintained by this organization
• The agentmessaging.org website

Out of scope:

• Third-party implementations
• Provider-specific issues (contact the provider directly)

The protocol includes several security mechanisms:

1. Cryptographic Signatures - All messages are signed with Ed25519 keys
2. Key Verification - Public keys are registered with providers and verified on receipt
3. Transport Security - TLS 1.3+ required for all provider communication
4. Rate Limiting - Providers must implement rate limiting to prevent abuse

For detailed security architecture, see spec/07-security.md.

We appreciate responsible disclosure. With your permission, we'll acknowledge your contribution in our release notes and security advisories.

• Security issues: security@agentmessaging.org
• General questions: hello@agentmessaging.org
• Protocol discussions: GitHub Discussions