Use this section to tell people about which versions of your project are currently being supported with security updates.

We take the security of SuperOptiX very seriously. If you discover a security vulnerability, please follow these steps:

1. Do not open a public issue. This gives malicious actors a chance to exploit the vulnerability before we can fix it.
2. Email us directly. Please send a detailed report to security@super-agentic.ai.
3. Include details. Please provide as much information as possible, including:
   • Steps to reproduce the vulnerability.
   • Versions of SuperOptiX and Python being used.
   • Any relevant configuration files or code snippets.

We will acknowledge your report within 48 hours and provide an estimated timeline for a fix. We appreciate your cooperation in disclosing vulnerabilities responsibly.

The Agent2Agent (A2A) protocol has known protocol-level risks documented in A2ABreak (arXiv:2609.10871). Examples include cross-client context injection, unattested skill claims, and related discovery or interruption gaps. SuperOptiX treats these as protocol risks for operators to understand; see docs/guides/a2a-conformance.md for how the public catalogue hardens multi-tenant task access and what card-review reports.

If you believe you have found an implementation vulnerability in SuperOptiX itself (not a general A2A protocol limitation), please report it using the process above.

Agent Card name is presentational metadata, not a stable identity (arXiv:2609.27624). Name-keyed peer routing caused wrong-peer dispatch in most OSS A2A integrations studied in that paper.

SuperOptiX checklist (mirrors SuperQode), citing the A2A Agent Name Collision paper:

• Route and store peers by normalized URL (origin-bound ID), never by remote Agent Card name.
• Treat card name as a local/presentational alias only.
• Reject ambiguous alias lookups with AmbiguousAgentName; never silently pick among colliding names.
• Keep skills_from_card / routing skill refs URL-keyed, not keyed by card.name.
• Migrate any legacy name-keyed peer store to URL keys on load.
• Keep connect/discover entrypoints URL-based.
• Add regression tests: two peers, same card name, different URLs → first retained, second does not overwrite; alias get with two URLs raises.