Security policy

Reporting a vulnerability

Please do not open a public issue. Report privately by email to the maintainers, or use GitHub's private vulnerability reporting on the repository. Include steps to reproduce and the affected version. See SECURITY.md in the repository for the full responsible-disclosure process.

How CodeYinkx limits risk

• Reviewed code is treated as untrusted data and is never executed.
• The repository's own analyzer configuration is not trusted (ruff --isolated).
• Webhooks require a valid HMAC-SHA256 signature and are deduplicated.
• Installation tokens are short-lived and never persisted.
• Reviews only ever submit a COMMENT review.
• Prompt-injection attempts in code are framed as data, not instructions.

Prompt injection cannot be eliminated. We test the implemented safeguards (secret redaction, delimited untrusted content, path and line validation) and document residual risk rather than claiming it is solved.