# Security Policy

`@tychilabs/agent-finance` handles local agent identity, encrypted wallet material on the agent's device, and signed transaction or x402 flows.

**Do not open a public GitHub issue for security vulnerabilities.**

Report privately to **yash@tychilabs.com** with:

- package version
- environment details
- steps to reproduce
- whether TYI seed, EVM private keys, session credentials, JWTs, or signed payloads are exposed

## Security model

- TYI seed stays on the agent's device in a local vault (`~/.tyi` by default).
- EVM private key stays in the local encrypted vault — not on Tychi's servers, not with the LLM provider.
- Session passwords and LLM API keys are sent to Tychi when you configure a session.
- Transaction and x402 signatures are produced locally on the agent's device, then submitted to Tychi for broadcast or resume.

## In scope

- unintended plaintext exposure of seed or EVM private key
- broken vault encryption or unlock logic
- signing the wrong transaction or x402 payload
- leaking JWTs, session credentials, or API keys through logs or helpers
- incorrect ERC-8004 manifest generation from the SDK

## Out of scope

- third-party RPC or LLM provider issues
- Tychi service bugs not influenced by SDK behavior
- local machine compromise

We aim to acknowledge reports promptly, reproduce, fix or mitigate, and note fixes in release notes.