# Security Policy

a2a-passport is an authentication/authorization library -- a bug here can
mean forged tokens or bypassed audience/scope checks across every agent
that depends on it. Please report vulnerabilities privately.

## Reporting a vulnerability

Use GitHub's private vulnerability reporting for this repository
(Security tab -> "Report a vulnerability") rather than opening a public
issue or pull request. This lets maintainers assess and patch the issue
before it's publicly disclosed.

Please include:
- The version of `a2a-passport` affected.
- Which component is affected (`OAuth2ClientCredentialsProvider`,
  `SharedSecretVerifier`, `JWKSVerifier`, `PassportAuthMiddleware`, etc).
- A minimal reproduction, if possible.
- The impact as you understand it (e.g. "verifier accepts a token for the
  wrong audience under condition X").

## Scope notes

- `a2a_passport.testing.mock_idp` (the HS256 shared-secret mock IdP) is a
  test fixture, not part of the production security surface. Using it
  against real traffic is a usage error, not a library vulnerability --
  but please still report it if the README/docs fail to make that clear
  enough to prevent the mistake.
- Vulnerabilities in `a2a-sdk` itself (the upstream A2A protocol
  implementation this library builds on) should be reported to that
  project, not here.

## Supported versions

Pre-1.0: only the latest published release on PyPI receives security
fixes. This will expand once the project reaches a 1.0 API-stability
commitment.
