English | Español

Do not report security vulnerabilities through public GitHub issues.

Instead, use GitHub's private vulnerability reporting:

1. Go to github.com/drzioner/gitwise/security/advisories
2. Click "Report a vulnerability"
3. Fill in the details

You can also email drzioner@gmail.com with the subject gitwise security: <brief description>.

• Type of vulnerability (e.g., command injection, path traversal, privilege escalation)
• Full steps to reproduce
• Affected versions
• Potential impact
• Suggested fix (if you have one)

• Acknowledgment: within 48 hours
• Initial assessment: within 7 days
• Fix and disclosure: depends on severity, typically within 30 days

gitwise includes these security measures:

• Minimal runtime dependencies: rich, rich-argparse, and shtab; Git operations use subprocesses.
• Signing configuration preservation: setup and setup-agents do not modify commit.gpgsign, user.signingkey, or credentials.
• Agent bypass guards: generated rules deny known signing and hook bypass flags.
• Hardened subprocesses: Git config/command injection variables are scrubbed and external processes use explicit timeouts.
• Secret scanning: diff --scan-secrets and commit detect high-confidence credential patterns and redact previews.
• Sandboxed symlinks: _safe_create_symlink applies TOCTOU and path traversal protections.
• Pinned CI actions: core third-party GitHub Actions use immutable SHAs.
• Dependency and shell audits: CI runs pip-audit and shellcheck.
• Branch protection: main requires passing CI and review for external contributions.