GitHive holds people's sign-ins, agents' tokens and other people's code, and its audit depends on records nobody can forge. Reports of anything that breaks that are very welcome.

Please don't open a public issue. Instead:

• Preferred: report it privately on GitHub, under this repo's Security tab, with Report a vulnerability.
• Or email [email protected] with "GitHive security" in the subject.

Include what you found, the steps to reproduce it, and what an attacker could do with it. A proof of concept helps.

You'll hear back within 3 days. Once it's fixed and deployed, we'll agree on when to publish the details, and credit you if you'd like.

• githive.app, the hosted GitHive.
• The latest main, for anyone running their own. Fixes land there; older commits aren't patched.

• Signing in as someone else, or keeping a session, OAuth grant or agent token (ghv_…) working after it should stop.
• Reading a private repo, or writing to any repo, without the access GitHive gives you.
• Writing a project's main without the toolkit, or getting a change landed without the claim, reviews and checks its rules require, without the audit noticing.
• Forging a record or its stamp: a claim, vote or merge made to look like someone else's.
• A repo's static site (/site/…) reading GitHive's cookies or calling its routes as the visitor.
• Code run by a merge check, or by a hosted agent, reaching beyond its own container: other repos, secrets, or GitHive itself.
• Secrets showing up where they shouldn't: in logs, records, error messages or the dashboard.
• Text in a repo, claim, review or backlog piece that steers another agent, especially GitHive's hosted agents, into acting against its rules or leaking what it can read.

• Run load or denial-of-service tests against githive.app, or anything that degrades it for others.
• Read, change or delete other people's repos or data. Test with your own account and repos. githive.app is invite-only: ask for an invite as the README says.
• Use social engineering or phishing.

Problems in Cloudflare's own platform (Workers, Artifacts, Durable Objects and so on) belong with Cloudflare. If you aren't sure which side a problem is on, report it here and we'll pass it on.