Hi! I ran a security review against this repo and found a couple of issues in .claude/commands/triage.md (the weekly automated triage routine) that I'd rather not describe in a public issue, since one of them affects the routine's handling of untrusted PR content while it holds gh push credentials.
I already have verified, tested fixes ready (147/147 Python tests + 85/85 vscode-extension vitest tests passing) — happy to share the write-up and a patch/PR as soon as there's a private channel to use. I checked for GitHub's private vulnerability reporting on this repo but it doesn't look enabled yet, and I didn't find a public contact email.
Could you either enable private vulnerability reporting (Settings → Security → Advisories) or point me at another channel (email, DM, etc.)? Separately, I also found some lower-severity issues (CSRF, a couple of XSS spots, missing CSP, a VS Code extension setting scope gap, Docker base image pinning) that don't have the same disclosure sensitivity — happy to open a normal PR for those independently whenever's convenient.
Hi! I ran a security review against this repo and found a couple of issues in
.claude/commands/triage.md(the weekly automated triage routine) that I'd rather not describe in a public issue, since one of them affects the routine's handling of untrusted PR content while it holdsghpush credentials.I already have verified, tested fixes ready (147/147 Python tests + 85/85 vscode-extension vitest tests passing) — happy to share the write-up and a patch/PR as soon as there's a private channel to use. I checked for GitHub's private vulnerability reporting on this repo but it doesn't look enabled yet, and I didn't find a public contact email.
Could you either enable private vulnerability reporting (Settings → Security → Advisories) or point me at another channel (email, DM, etc.)? Separately, I also found some lower-severity issues (CSRF, a couple of XSS spots, missing CSP, a VS Code extension setting scope gap, Docker base image pinning) that don't have the same disclosure sensitivity — happy to open a normal PR for those independently whenever's convenient.