Security Contact Request - Vulnerability Disclosure

[ibrahmsql]

hello,

I found security issue how I can report it?

best regards

[ibrahmsql]

any update?

[ameen7626]

what's the security issue?

[ashpreetbedi]

@ibrahmsql you're free to reach out to me but this is an open-source repo, you find an issue please open a PR

[ibrahmsql]

I confirmed a unauthenticated vulnerability in the Agent API (POST /agents/dash/runs) that allows database schema enumeration and full data exfiltration via the agents sql tools
to avoid public disclosure, could you please enable GitHub Security Advisories / private vulnerability reporting or share a security contact email so i can provide the full PoC and reproduction steps responsibly? once you reproduce it I can provide a patch/PR
I would appreciate your support in opening a GitHub Security Advisory for this report so we can manage the fix privately and coordinate the CVE process properly to document the resolution.
Best regards,
Yiğit ibrahim