Report a security issue

Report a vulnerability or a security concern about any A2A Cosmetics surface or the MCP door through the contact form, marked "security", or per /.well-known/security.txt. Please include the surface, the path, and enough to reproduce. GSC acknowledges reports and does not pursue good-faith researchers who respect the record and the people in it.

Signing keys: the hub's public keys are at /.well-known/jwks.json; every Agent Card, record and receipt is verifiable against them.