Given the early stage of the project, we currently only support the latest version with security updates:

We take the security of Eliza seriously. If you believe you have found a security vulnerability, please report it to us following these steps:

1. DO NOT create a public GitHub issue for the vulnerability
2. Send an email to [email protected] with:
   • A detailed description of the vulnerability
   • Steps to reproduce the issue
   • Potential impact of the vulnerability
   • Any possible mitigations you've identified

• Initial Response: Within 48 hours, you will receive an acknowledgment of your report
• Updates: We will provide updates every 5 business days about the progress
• Resolution Timeline: We aim to resolve critical issues within 15 days
• Disclosure: We will coordinate with you on the public disclosure timing

1. API Keys and Secrets

   • Never commit API keys, passwords, or other secrets to the repository
   • Use environment variables as described in our secrets management guide
   • Rotate any accidentally exposed credentials immediately

2. Dependencies

   • Keep all dependencies up to date
   • Review security advisories for dependencies regularly
   • Use pnpm audit to check for known vulnerabilities

3. Code Review

   • All code changes must go through pull request review
   • Security-sensitive changes require additional review
   • Enable branch protection on main branches

1. Environment Setup

   • Follow our secrets management guide for secure configuration
   • Use separate API keys for development and production
   • Regularly rotate credentials

2. Model Provider Security

   • Use appropriate rate limiting for API calls
   • Monitor usage patterns for unusual activity
   • Implement proper authentication for exposed endpoints

3. Platform Integration

   • Use separate bot tokens for different environments
   • Implement proper permission scoping for platform APIs
   • Regular audit of platform access and permissions

• Environment variable based secrets management
• Type-safe API implementations
• Automated dependency updates via Renovate
• Continuous Integration security checks

1. Q4 2024

   • Automated security scanning in CI pipeline
   • Enhanced rate limiting implementation
   • Improved audit logging

2. Q1 2025

   • Security-focused documentation improvements
   • Enhanced platform permission management
   • Automated vulnerability scanning

We follow a coordinated disclosure process:

1. Reporter submits vulnerability details
2. Our team validates and assesses the report
3. We develop and test a fix
4. Fix is deployed to supported versions
5. Public disclosure after 30 days or by mutual agreement

We believe in recognizing security researchers who help improve our security. Contributors who report valid security issues will be:

• Credited in our security acknowledgments (unless they wish to remain anonymous)
• Added to our security hall of fame
• Considered for our bug bounty program (coming soon)

As an MIT licensed project, users should understand:

• The software is provided "as is"
• No warranty is provided
• Users are responsible for their own security implementations
• Contributors grant perpetual license to their contributions

• Security Issues: [email protected]
• General Questions: Join our Discord
• Updates: Follow our security advisory page