We take security seriously. If you discover a security vulnerability in A2A, please report it responsibly.

Please do NOT report security vulnerabilities through public GitHub issues.

Instead, please report them via one of the following methods:

1. GitHub Security Advisories (Preferred)

   • Go to the Security tab
   • Click "Report a vulnerability"
   • Provide details about the vulnerability

2. Email

   • Send details to the repository owner
   • Include "SECURITY" in the subject line

Please include as much of the following information as possible:

• Type of vulnerability (e.g., authentication bypass, injection, etc.)
• Location of the vulnerable code (file path, line numbers)
• Steps to reproduce the vulnerability
• Potential impact of the vulnerability
• Suggested fix (if you have one)

• Initial Response: Within 48 hours
• Status Update: Within 7 days
• Resolution Target: Within 30 days (depending on complexity)

1. Acknowledgment: We'll confirm receipt of your report
2. Assessment: We'll investigate and assess the severity
3. Updates: We'll keep you informed of our progress
4. Resolution: We'll work on a fix and coordinate disclosure
5. Credit: With your permission, we'll credit you in the release notes

When using A2A, please follow these security practices:

• Never commit credentials to version control
• Use environment variables or a .env file for sensitive data
• Keep your API keys and tokens secure
• Use read-only API tokens when possible

• The audible_auth.json file contains sensitive authentication data
• Store it in the data/ directory (which is gitignored)
• Don't share authentication files
• Regularly rotate your credentials

# Recommended permissions for sensitive files
chmod 600 .env
chmod 600 data/audible_auth.json
chmod 700 data/

• Use HTTPS for your Audiobookshelf server when possible
• Be cautious when using the tool on shared networks
• Consider using a VPN for remote access

We use the following tools to maintain security:

• Bandit: Python security linter (runs in CI)
• Dependabot: Automated dependency updates
• Dependency Review: Reviews PRs for vulnerable dependencies
• Pre-commit hooks: Security checks before commits

# Run Bandit security scanner
make lint

# Or directly
bandit -r src/ -c pyproject.toml

• ABS API tokens have full access to your Audiobookshelf server
• Treat them with the same care as passwords

• The SQLite cache may contain metadata from your library
• Cache files are stored in data/cache/ (gitignored)
• Clear cache if sharing the project directory

• Logs may contain file paths and metadata
• Debug logging may reveal sensitive information
• Review logs before sharing for troubleshooting

Security updates will be released as patch versions and announced via:

• GitHub Releases
• CHANGELOG.md
• Security Advisories (for critical issues)

Thank you for helping keep A2A secure! 🔒