No releases — only main is supported; redeploy from it.
No public issue/PR/discussion — report privately.
Include impact, the tested SHA, steps or a PoC. Test only deployments you own; keep no data that isn't yours.
Ack 5 days, verdict 14 days, advisory after fix. No SLA/bounty (single maintainer); nudge the thread after 14 silent days.
In: webhook-signature bypass/replay; auth bypass (REST, internal-cron, CLI hook, Telegram callback); cross-tenant reads; stored-credential recovery; merge below the score gate or on a stale score; injection/traversal/SSRF/notification-injection via analyzed content; pre-auth DoS.
Out: your deploy config; findings presupposing your key, session, or shell; third-party services and the analyzers; scanner output without a PoC. Deliberate, not a bug: unescaped AI summaries in notifications.
- GitHub API,
DATABASE_URL— files, diffs, scores, summaries; unavoidable, self-host the DB. - Anthropic/OpenAI — diff + commit message; unset
ANTHROPIC_API_KEY/OPENAI_API_KEY(OpenAI off by default). - Telegram, Discord/Slack/n8n/webhook/SMTP — score, grade, AI summary; unset
TELEGRAM_BOT_TOKEN/SMTP_*, blank Settings URLs. - Railway/semgrep.dev — deploy status; rulesets + anon metrics, not source; blank the Railway token,
SEMGREP_SEND_METRICS=off. - Other analyzers are local;
golangci-lint/clippyfetch uncached deps.
SESSION_SECRET 32+ random bytes · TOKEN_ENCRYPTION_KEY + STRICT_TOKEN_ENCRYPTION=true · ENVIRONMENT=production · HTTPS APP_BASE_URL · GITHUB_WEBHOOK_SECRET · TELEGRAM_WEBHOOK_SECRET · INTERNAL_CRON_API_KEY ≠ API_KEY · DB_SSLMODE=require, DB not public · review thresholds before auto_merge. Never API_AUTH_DISABLED=1 in production (keyless REST then 503). env-vars.md