omg is an independent, community project. If you find a security vulnerability, please report it privately — do not open a public GitHub issue.

Preferred channel: open a private GitHub Security Advisory on this repository.

Please include enough detail to reproduce (affected version/commit, steps, and impact). We'll acknowledge the report and work with you on a fix and disclosure timeline.

Vulnerabilities in the upstream grok-build runtime that omg is built on should also be reported to xAI through their own process; issues specific to omg's additions (the provider layer, the bridge, the agent cast) belong here.