This project is in early development (0.x). Security fixes land on the latest main branch; there are no backported release lines yet.

If you discover a security vulnerability, please do not open a public GitHub issue. Report it privately via GitHub's private vulnerability reporting:

1. Go to https://github.com/twz007/java-obs-agent/security/advisories/new
2. Click Report a vulnerability

Please include:

• A description of the issue and its impact.
• Steps to reproduce (proof of concept).
• Affected version / commit.

We will acknowledge within 72 hours and aim to ship a fix + publish a security advisory in a timely manner, crediting you unless you prefer to remain anonymous.

The agent runs inside a target JVM and exposes an HTTP server (MCP + chat). Security-relevant issues include: authentication/authorization bypass, default network exposure, injection via tool arguments / scrubber regex, and sensitive-data leakage in tool results.

Out of scope (self-inflicted misconfiguration, documented as expected behavior):

• Setting host=0.0.0.0 without a token (the default is loopback-only on purpose; opting into wildcard binding is the operator's explicit choice).
• Putting a known-weak token in the URL query string (?token=), which may be captured by browser history / logs / Referer headers.

• The HTTP server binds to 127.0.0.1 by default (not exposed). Set host=0.0.0.0 only behind a firewall/reverse proxy and with token set.
• Instrumentation tools (watch_method / trace_request) are disabled by default (enableInstrumentation=false).
• Tool results pass through a configurable scrubPatterns regex scrubber (tokens / PII) before reaching the LLM or the caller.
• Request bodies are capped (2 MB) to mitigate oversized-payload DoS.
• HTTP error responses return generic messages; raw stack traces go to System.err only.