Please do not open a public issue for a security problem.
Report privately using GitHub's Report a vulnerability button on this repository (Security → Advisories → Report a vulnerability). If that is unavailable, contact the maintainers directly and say only that you have a security report — do not include exploit details in a public channel.
Please include:
- the affected version or commit,
- a description of the impact,
- steps to reproduce, ideally against
GITHUB_MODE=mock, - any suggested fix.
We will acknowledge within a few days and aim to ship a fix before publishing details. We credit reporters unless asked not to.
| Risk | Mitigation |
|---|---|
| Untrusted repository code execution | Reviewed code is never run. Only trusted analyzer binaries run, against bounded inert input, in a private temp workspace with a minimal environment. |
| Malicious analyzer configuration in a reviewed repo | Ruff runs with --isolated; Bandit is invoked without a config path. A pull request cannot disable rules. |
| Forged webhooks | HMAC-SHA256 signature over the raw body, constant-time compare, rejected before parsing. Missing configuration fails closed. |
| Replayed webhooks | Delivery ids are stored uniquely and deduplicated; jobs are keyed by repository + PR + commit. |
| Oversized payloads | Request bodies are capped (WEBHOOK_MAX_PAYLOAD_BYTES), analyzer output is capped, files are size-limited. |
| Credential leakage | Installation tokens are short-lived and never persisted. Secrets are redacted before any prompt, log line or comment. Persisted tokens use authenticated encryption. |
| Prompt injection from source code | Repository content is delimited and explicitly framed as data. AI output is schema-validated and its file paths are checked against the diff. |
| SSRF via AI configuration | The provider base URL is administrator-configured only; users cannot supply a URL from the dashboard. |
| Cross-user access | Every dashboard route requires a session and scopes rows to the authenticated identity; object ids are never trusted. |
| CSRF | State-changing dashboard actions require a per-session token, compared in constant time. |
| Commenting in the wrong place | Every inline position is re-validated against the diff before publishing; unmappable findings go to the summary. |
- Prompt injection cannot be eliminated. We test the implemented safeguards (redaction, delimiters, path validation) but a sufficiently novel injection could still influence a model's output. AI findings are labelled as hypotheses and never act on the repository.
- Third-party AI privacy cannot be verified. We cannot guarantee a configured provider's retention or training policy. AI is off by default and off for private repositories unless the owner opts in.
- Analyzer false negatives are inherent: absence of findings is not proof of safety.
- Multi-tenant isolation relies on application-level checks, not separate databases per tenant.
The main branch is the supported version. Please reproduce reports against it.