Please report security problems privately. Use GitHub's Security tab, then Report a vulnerability. Don't open a public issue for them.

Include what you found, the version (from package.json, or the release you installed), and the steps to reproduce it. We'll confirm receipt, work on a fix, and credit you in the release notes if you'd like.

In scope: the NexurBots app and the local servers it runs for Hermes (the PC control server, the group tools server and the event listener).

Out of scope: Hermes Agent itself. Report those issues to Nous Research.

Only the latest release receives fixes.