The Azure Support Agent connects to live Azure tenants and handles credentials, tokens, and other secrets. We take security issues seriously and appreciate responsible disclosure.

Only the latest released version receives security updates.

Please do not open a public issue for security vulnerabilities.

Report privately through GitHub's built-in private vulnerability reporting:

1. Go to the Security tab of this repository.
2. Click Report a vulnerability (GitHub Security Advisories).
3. Provide a clear description, reproduction steps, affected version/commit, and any relevant logs (with secrets redacted).

If you cannot use GitHub's private reporting, open a minimal issue asking a maintainer to contact you — without disclosing the vulnerability details.

Application dependency audits and container scans cover different Python environments. Azure CLI installs its own Python packages under /opt/az; updating backend/requirements.txt does not patch that environment. Both backend container definitions upgrade its security-sensitive packages separately.

After updating those packages, scan the rebuilt image and verify that Azure CLI and its Resource Graph extension still load. Confirm fixes with fresh GitHub security scans rather than dismissing alerts solely because application requirements changed.

Local image gates and GitHub container scanning fail on fixable vulnerabilities at every severity, including advisories whose severity is still unknown. A clean critical-only scan is not sufficient. The image rebuilds Azure Quick Review from checksum-verified source with separately pinned, patched Go and embedded modules.

The frontend uses Tailwind 4 to avoid the unpatched braces dependency in the Tailwind 3 build chain. Its KaTeX override keeps Mermaid's transitive renderer on a patched release; validate diagram and math rendering when updating that override.

• A description of the issue and its impact.
• Steps to reproduce (a proof of concept if possible).
• The affected version, image tag, or commit SHA.
• Your assessment of severity, if any.

• We will acknowledge your report as soon as we can.
• We will investigate and keep you informed of progress.
• We will credit you in the advisory once a fix is released, unless you prefer to remain anonymous.

• Never include real secrets (API keys, client secrets, tokens, connection strings) in a report — redact them.
• The application runs read-only by default; please respect that posture when testing and do not attempt to access data you are not authorized to.
• Do not run tests against systems or tenants you do not own or have explicit permission to test.

Thank you for helping keep the project and its users safe.