Security

Hawkeye handles GitHub App installation tokens, runner tokens and the review results of private repositories, so reports are taken seriously and handled privately.

Report a vulnerability

Use GitHub's private vulnerability reporting for this repository: open a private advisory. Do not open a public issue for anything that could be a vulnerability.

You get an acknowledgement within three days and a fix or a decision within thirty. Credit goes to the reporter in the release notes unless they prefer otherwise.

What is in scope

• The control plane: sign-in, the GitHub App webhook, the runner API, token handling.
• The runner: the daemon, the review harness and the worktree it reviews in.
• The review contract: the fences around untrusted repository content in the prompt.
• The hosted instance at hawkeye-review.vercel.app.

Findings that need physical access to a machine, or that only affect a self-hosted instance configured against the documentation, are welcome too and may be handled as hardening.

Supported versions

The latest published hawkeye-review and the current main of the control plane. The full policy is SECURITY.md in the repository.