ActionRail is a runtime safety control for AI agents: it verifies an agent's consequential tool calls against your systems of record before they execute. Because it sits in a security-sensitive path, we take vulnerability reports about the SDK, control plane, and console seriously, and we're grateful for the community's help keeping it trustworthy.

This policy covers vulnerabilities in ActionRail itself. For what ActionRail is and is not designed to protect against — its threat model and boundaries — see the Security model documentation.

Please report security issues privately. Do not open a public GitHub issue, discussion, or pull request for a suspected vulnerability.

Use either channel:

• GitHub private vulnerability reporting (preferred): on https://github.com/ToolJet/ActionRail, open the Security tab → Report a vulnerability.
• Email: security@tooljet.com

Please include:

• the affected component (SDK / control plane / console) and version or commit,
• a description of the issue and its security impact,
• steps to reproduce, and a proof of concept if you have one,
• any suggested remediation.

If you'd like to send sensitive details encrypted, say so in your first message and we'll arrange a key.

• We aim to acknowledge your report within 3 business days.
• We'll keep you updated on our assessment and the remediation timeline.
• We practice coordinated disclosure: we'll agree a disclosure date with you, and we're happy to credit you (or keep you anonymous) in the advisory and release notes.
• Please give us reasonable time to ship a fix before any public disclosure.

Because ActionRail is a safety control, we especially want to hear about:

• Decision bypass — a crafted argument, rule, or timing that lets a consequential tool run when it should have been blocked or held.
• Data leakage — any path where raw argument values or source credentials reach the control plane, logs, cache, or model-facing output. ActionRail's contract is metadata-only; see Data privacy.
• Cross-tenant access in a hosted/multi-tenant control plane.
• Secret exposure in ${env:VAR} resolution, the config cache, or the reporting outbox.

In scope: the actionrail SDK, the control plane (Django API) and console, and any example or documentation that could lead a user into an insecure configuration.

Out of scope (please report to the relevant project instead): vulnerabilities in your own agents, tools, or systems of record; third-party dependencies (report upstream — but do tell us if ActionRail's usage makes them exploitable); issues requiring an already-compromised host or physical access; and self-inflicted misconfiguration that the documentation warns against.

ActionRail is pre-1.0 (beta). Security fixes land on the latest release and the master branch. Please reproduce against the latest version before reporting.

Thank you for helping keep ActionRail and its users safe.