Security

If you find an ACP attack path that this mapping misses, or a way a test in Section 6 can pass while the control fails, report it privately to the maintainer, Craig Thomas Ellrod, through a GitHub security advisory on this repository before public disclosure.

Vulnerabilities in ACP itself belong with the ACP maintainers (https://github.com/agentic-commerce-protocol/agentic-commerce-protocol/security), not here. Do not post exploit code or undisclosed vulnerability details in issues or pull requests.