Bobby follows semantic versioning. Security fixes are applied to the latest released 1.x version.

Please do not open a public issue for security vulnerabilities.

Instead, report them privately via GitHub Security Advisories, or email the maintainer at ccevans1@gmail.com.

Include the affected version, a description of the issue, and steps to reproduce if possible. You can expect an acknowledgement within a few days.

Bobby is a local developer CLI. A few things worth knowing:

• The dashboard (bobby dashboard) binds to 127.0.0.1 with no authentication by design. Do not expose it to a network you don't trust; if you override --host, Bobby prints a warning.
• Agent prompts generated by bobby run are meant to be executed by an AI coding agent with tool access. Review what you run, especially on untrusted tickets.