Security

Last updated 18 September 2026 · version 1.0

1. Reporting a vulnerability

Email operations@praesi.ai with a description, the version and platform, and steps to reproduce. Please do not include real personal data or secrets. We will:

• acknowledge your report within 3 working days;
• give you an initial assessment within 10 working days;
• keep you informed while we fix it, and aim to release a fix for serious issues within 30 days;
• credit you publicly when it is fixed, if you want us to.

Our machine-readable contact is at /.well-known/security.txt. Where we are required to under the EU Cyber Resilience Act, we notify actively exploited vulnerabilities and severe incidents to the competent authorities within the required time and inform affected users.

2. Safe harbour

If you research in good faith (on your own devices and accounts, without accessing other people’s data, degrading our services, or extorting us) and give us reasonable time to fix an issue before publishing, we consider your research authorised, will not pursue or support legal action against you for it, and will work with you openly.

Out of scope: denial-of-service attacks, social engineering of our staff, physical attacks, spam, and reports from automated scanners with no demonstrated impact.

3. How AgentWarden is built

• Local by design. Everything it watches is analysed on your device. Your code and transcripts are never uploaded.
• Signed everything. The macOS app is signed with our Apple Developer ID and notarised by Apple; Windows releases are code-signed through Microsoft’s Trusted Signing service. Every software update and every detection-rules bundle carries our signature and is refused if it does not verify.
• Read-only unless you say otherwise. It observes; it does not change your security settings. Decoy files and containment exist only if you turn them on, and containment acts only after rehearsing on your own machine, only on a session judged hijacked, and never on your own terminal, shell or remote access.
• Fails open. If AgentWarden itself fails, your agents keep working. It is never a single point of failure for your work.
• Minimal network surface. The Windows interface listens only on the local machine, with a per-launch secret, strict host and origin checks and a strict content security policy. The phone relay carries only end-to-end encrypted messages.
• Few dependencies. The Windows and Linux client has no third-party runtime dependencies at all, so there is no package supply chain to poison.
• Tested against real attacks. Before each release we replay a red-team suite, including recent real-world attacks on AI agents, through the shipping detection engine on each platform and checks both reach the same verdicts.