Please do NOT open a public GitHub issue for security vulnerabilities.

Instead, use GitHub Private Vulnerability Reporting:

👉 Security → Report a vulnerability

This is fully private — only you and the maintainer can see it until it's resolved and disclosed.

• A clear description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (optional but appreciated)

We follow coordinated disclosure. Reporters who follow this policy will be credited in the release notes.

In scope:

• gn-core engine (arbitrary code execution via crafted git objects)
• github-bridge API server (auth bypass, SSRF, injection)
• gn-cli / gn-tui (path traversal, shell injection)
• Chrome extension (XSS on GitHub pages, data exfiltration)

Out of scope:

• Git itself (report to the Git security team)
• GitHub's platform (report to GitHub)
• Theoretical attacks without a working proof of concept