Skip to content

Repository navigation

Security: paulmann/github-agent

Security

SECURITY.md

Security policy

Supported versions

Version Supported
1.1.x yes
1.0.x yes
< 1.0.0 no

Reporting a vulnerability

Use the private channel: the Security tab → Report a vulnerability. Do not open a public issue; a vulnerability report in a public tracker discloses it before a fix exists.

Include:

  • the pack version (python tools/ghagent.py --version) and the Python version;
  • the command that reproduces the problem and its output;
  • what the risk actually is: which file is read, overwritten or published.

Expect an answer within seven days. An accepted vulnerability is fixed on a branch, then a patch release carries a Security entry in CHANGELOG.md.

Threat model

The pack works on a local tree and with the GitHub API on behalf of the owner. The dangerous places:

Place Risk Protection
wiki publish --push overwriting or deleting someone else's pages without --push it is a dry run; pages the build does not contain are kept, deletion requires --prune
wiki publish with an empty manifest publishing an empty wiki an empty page set is an error before any write
meta apply --write replacing the topic list the list is merged with the existing one; --replace-topics is a separate flag
install / uninstall deleting a foreign directory uninstall requires the .install.json manifest and refuses otherwise
doc / audit / privacy reading files that contain secrets values are never printed: a finding names the rule, the path and the line
changelog release --write corrupting the changelog the file is validated again after writing, and errors are reported immediately
assets render overwriting an existing image files are written only with --write, and the target names are fixed

What the pack does not do

  • It sends nothing anywhere except api.github.com, and only for audit --repo, meta and wiki publish.
  • It stores no credentials and prints none: it uses the existing gh authorisation or the GITHUB_TOKEN variable.
  • It never runs git push --force and never rewrites history.

There aren't any published security advisories