GitAuk may interact with GitHub repositories, including potentially private repositories. Security issues involving repository access, credentials, API authorization, data isolation, or unsafe code analysis are especially important.

Please do not publicly disclose an unpatched security vulnerability.

Use the project's private security reporting mechanism once configured.

Until that mechanism is available, contact the project maintainers privately rather than opening a public issue containing sensitive details.

Contributors should pay particular attention to:

• GitHub access tokens.
• OAuth permissions.
• Repository authorization.
• Private repository contents.
• API authentication and authorization.
• Webhook validation.
• Path traversal.
• Malicious repository files.
• Unsafe execution of repository code.
• Dependency vulnerabilities.
• Log leakage.

Never commit credentials, tokens, private keys, or other secrets.

Use environment variables or an approved secret-management solution.

AI-assisted code detection results are estimates and should not be treated as security or authorship proof.

The project's vulnerability disclosure and supported-version policy will be finalized before production release.