AutoBroker is pre-1.0 and under active development. Only the current main branch receives fixes. There is no stable release line.

Please do not open a public GitHub issue for security vulnerabilities.

Report privately via GitHub Security Advisories or by email to [email protected].

Include: a description of the issue, reproduction steps, and the potential impact. You will receive a response within a few business days.

AutoBroker handles sensitive data by design:

• Private Gmail content — dealer replies read via the user's own OAuth token. That content is passed to the configured LLM provider for extraction.
• Dealer PII — dealer contact information, quotes, and negotiation threads live in a local SQLite database.
• LLM API keys — provider keys are stored in the local OS keychain or .env file and must never appear in tracked files.

• Local-first. All data lives under ~/.autobroker-ts/ on the user's machine. The app is not a multi-tenant service; there is no cloud backend.
• Human approval gates on all irreversible actions. Side effects can physically reach browser.submit or gmail.send only through the L2 in-process gate handler, which fails closed. AUTOBROKER_MODE is the single send-control variable: AUTOBROKER_MODE=test resolves every send to the local fake mailbox (the floor for all test/CI runs).
• Secrets are never committed. .env, keys.json, and OAuth tokens are in .gitignore. CI is verified to contain no real credentials.
• The three irreversible skills (dealer_web_lead_submit, negotiation_followup, dealer_closeout_email) really send in buyer mode through the single L2 human-approval gate (one action at a time), and fake-send in test mode — via the same AUTOBROKER_MODE switch as every other send. Their human approval is never hidden on any surface.

See CLAUDE.md for the full 12-point safety invariant set.