If you discover a security vulnerability in this project, please report it responsibly.

Do NOT open a public GitHub issue for security vulnerabilities.

Instead, please email: security@openan.com

Include the following in your report:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

We will acknowledge receipt within 48 hours and provide a fix or mitigation within 90 days. Valid reports will be credited in the release notes.

• Credential encryption: Passwords in credential config files support AES-256-GCM encryption via the A2AT_CRED_KEY environment variable. See Integration Guide.

• Custom AuthProvider: For environments requiring external identity providers (SSO, OAuth2, etc.), implement AuthProvider to control authentication without storing credentials locally. See Integration Guide.

• TLS/HTTPS: All agent communication supports HTTPS with configurable certificate verification. Self-signed certificates should be trusted through caCertsPath; sslVerify(false) is limited to controlled local diagnostics and does not disable hostname verification.