If you discover a security vulnerability in Archon, please report it privately via:

• GitHub: Report a vulnerability
• Email: security@twomathematicians.dev (if configured)

Please do not open a public issue. We aim to respond within 48 hours.

1. API Keys: Never commit .env files. Use environment variables or the ARCHON_OPENAI_API_KEY env var.
2. Agent Sandbox: Set ARCHON_AGENT_SANDBOX_DIR to restrict agent file access.
3. Content Safety: Enable ARCHON_CONTENT_SAFETY_ENABLED=true in production.
4. Path Validation: Archon validates file paths on CLI commands, but always validate user-supplied paths in your own integrations.
5. Dependencies: Run pip-audit or safety check periodically to check for known vulnerabilities.