Security fixes are applied to the latest release on the main branch.
Please do not open a public issue for suspected vulnerabilities. Contact the maintainer privately or open a GitHub private vulnerability report if available.
Include:
- Affected component: frontend, backend, deployment, or GitHub adapter.
- Reproduction steps.
- Impact summary.
- Whether a token, private repository, or user data could be exposed.
The backend is the only component that should access GITHUB_TOKEN. The frontend must never receive GitHub tokens or other private credentials.