Agent Harness Lab is a small companion app for the Harness Engineering
book, not a production ticketing platform.
Please report security concerns responsibly anyway, especially if they affect:
- request handling that can crash the demo server
- unsafe or misleading examples around ticket updates or JSON API usage
- example code that could teach a dangerous pattern by accident
- dependency or framework issues that materially change the safety story
This project intentionally includes limitations that would not be acceptable in production, such as:
- in-memory state
- simplified routing and data handling
- demo-oriented ticket data and status updates
- no authentication, persistence, or multi-user coordination
Those limits are part of the project scope, but dangerous inaccuracies should still be reported.
Please open a private security report if the hosting platform supports it, or contact the maintainers through the project channel you were given for this repo.
When reporting an issue, include:
- affected file or route
- what behavior you observed
- why it is risky or misleading
- steps to reproduce if relevant
Because this is a companion project, fixes may prioritize:
- correcting unsafe examples
- clarifying documentation
- tightening visible demo behavior around request validation and API access
over adding full production defenses that are outside the scaffold's intended scope.