Security: freema/codeforge

Security

Report a vulnerability

SECURITY.md

Security Policy

Reporting a vulnerability

Please report security issues privately, through GitHub Security Advisories. Do not open a public issue for anything exploitable.

CodeForge is maintained by one person, so please set expectations accordingly:

  • Acknowledgement within 7 days
  • An assessment, and a fix or a plan, within 30 days for anything confirmed
  • Credit in the advisory and release notes, unless you prefer otherwise

If you would rather not use GitHub, contact details are at tomasgrasl.cz.

Supported versions

Only the latest minor release receives security fixes. Fixes are not backported to earlier versions — upgrade to the current release.

VersionSupported
1.1.xYes
< 1.1No

Threat model

Running a session means executing a repository's code and letting an AI CLI decide what else to run, with approvals disabled. Repository content is attacker-controlled input, and prompt injection from within a repository is a realistic path — not a theoretical one.

Current isolation: the AI CLI runs in the same container as the server, dropped to a non-root user. That is a privilege boundary, not isolation. There is no per-session container, VM, or network policy yet.

What the server does contain:

  • The CLI subprocess receives an allowlisted environment rather than the server's, so the encryption key protecting the credential registry, the operator token, webhook secrets and the Redis URL never enter a session (internal/tool/runner/env.go).
  • Git credentials are supplied through short-lived GIT_ASKPASS scripts that are removed before the CLI starts. Tokens never reach the URL or .git/config.
  • Webhook-triggered work from authors without write access is refused by default (code_review.allow_untrusted_authors).
  • Opening a pull request always requires an explicit action. This is a hard-coded invariant, not a configuration flag.

What it does not do yet: isolate sessions from each other, from the SQLite database on the shared filesystem, or from the network. Per-session sandboxing, a credential-injecting model proxy, default-deny egress and a read-only tool tier for untrusted authors are planned.

Deploying safely

Until per-session isolation lands:

  • Point CodeForge only at repositories where everyone with push or PR access is trusted, and treat the host as part of that trust domain.
  • Leave code_review.allow_untrusted_authors at its default of false.
  • Give the server its own host or VM. Do not run it alongside unrelated workloads, and never expose the Docker socket to it.
  • Pin a released image tag rather than tracking :latest, so upgrades are deliberate.
  • Scope provider tokens to the repositories that actually need them, and rotate them if a session ever behaves unexpectedly.

See Deployment and Configuration for the details.

Scope

In scope: anything letting an untrusted PR author or repository reach the server's credentials, other sessions, or the host. Authentication and tenant isolation bypasses. Credential leakage through logs, API responses, or the session environment.

Out of scope: the absence of per-session sandboxing, which is documented above and on the roadmap; issues requiring operator-level access you already hold; and vulnerabilities in the AI CLIs themselves, which belong with their vendors.

There aren't any published security advisories

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Security: freema/codeforge
Security
Report a vulnerability

SECURITY.md

Security Policy
Reporting a vulnerability
Please report security issues privately, through
GitHub Security Advisories.
Do not open a public issue for anything exploitable.
CodeForge is maintained by one person, so please set expectations accordingly:
  • Acknowledgement within 7 days
  • An assessment, and a fix or a plan, within 30 days for anything confirmed
  • Credit in the advisory and release notes, unless you prefer otherwise
If you would rather not use GitHub, contact details are at
tomasgrasl.cz.
Supported versions
Only the latest minor release receives security fixes. Fixes are not
backported to earlier versions — upgrade to the current release.
VersionSupported
1.1.xYes
< 1.1No
Threat model
Running a session means executing a repository's code and letting an AI CLI
decide what else to run, with approvals disabled. Repository content is
attacker-controlled input, and prompt injection from within a repository is a
realistic path — not a theoretical one.
Current isolation: the AI CLI runs in the same container as the server,
dropped to a non-root user. That is a privilege boundary, not isolation. There
is no per-session container, VM, or network policy yet.
What the server does contain:
  • The CLI subprocess receives an allowlisted environment rather than the
server's, so the encryption key protecting the credential registry, the
operator token, webhook secrets and the Redis URL never enter a session
(internal/tool/runner/env.go).
  • Git credentials are supplied through short-lived GIT_ASKPASS scripts that
are removed before the CLI starts. Tokens never reach the URL or
.git/config.
  • Webhook-triggered work from authors without write access is refused by
default (code_review.allow_untrusted_authors).
  • Opening a pull request always requires an explicit action. This is a
hard-coded invariant, not a configuration flag.
What it does not do yet: isolate sessions from each other, from the SQLite
database on the shared filesystem, or from the network. Per-session
sandboxing, a credential-injecting model proxy, default-deny egress and a
read-only tool tier for untrusted authors are planned.
Deploying safely
Until per-session isolation lands:
  • Point CodeForge only at repositories where everyone with push or PR access is
trusted, and treat the host as part of that trust domain.
  • Leave code_review.allow_untrusted_authors at its default of false.
  • Give the server its own host or VM. Do not run it alongside unrelated
workloads, and never expose the Docker socket to it.
  • Pin a released image tag rather than tracking :latest, so upgrades are
deliberate.
  • Scope provider tokens to the repositories that actually need them, and rotate
them if a session ever behaves unexpectedly.
See Deployment and
Configuration for the
details.
Scope
In scope: anything letting an untrusted PR author or repository reach the
server's credentials, other sessions, or the host. Authentication and tenant
isolation bypasses. Credential leakage through logs, API responses, or the
session environment.
Out of scope: the absence of per-session sandboxing, which is documented above
and on the roadmap; issues requiring operator-level access you already hold;
and vulnerabilities in the AI CLIs themselves, which belong with their vendors.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: freema/codeforge
Security
Report a vulnerability

SECURITY.md

Security Policy
Reporting a vulnerability
Please report security issues privately, through
GitHub Security Advisories.
Do not open a public issue for anything exploitable.
CodeForge is maintained by one person, so please set expectations accordingly:
  • Acknowledgement within 7 days
  • An assessment, and a fix or a plan, within 30 days for anything confirmed
  • Credit in the advisory and release notes, unless you prefer otherwise
If you would rather not use GitHub, contact details are at
tomasgrasl.cz.
Supported versions
Only the latest minor release receives security fixes. Fixes are not
backported to earlier versions — upgrade to the current release.
VersionSupported
1.1.xYes
< 1.1No
Threat model
Running a session means executing a repository's code and letting an AI CLI
decide what else to run, with approvals disabled. Repository content is
attacker-controlled input, and prompt injection from within a repository is a
realistic path — not a theoretical one.
Current isolation: the AI CLI runs in the same container as the server,
dropped to a non-root user. That is a privilege boundary, not isolation. There
is no per-session container, VM, or network policy yet.
What the server does contain:
  • The CLI subprocess receives an allowlisted environment rather than the
server's, so the encryption key protecting the credential registry, the
operator token, webhook secrets and the Redis URL never enter a session
(internal/tool/runner/env.go).
  • Git credentials are supplied through short-lived GIT_ASKPASS scripts that
are removed before the CLI starts. Tokens never reach the URL or
.git/config.
  • Webhook-triggered work from authors without write access is refused by
default (code_review.allow_untrusted_authors).
  • Opening a pull request always requires an explicit action. This is a
hard-coded invariant, not a configuration flag.
What it does not do yet: isolate sessions from each other, from the SQLite
database on the shared filesystem, or from the network. Per-session
sandboxing, a credential-injecting model proxy, default-deny egress and a
read-only tool tier for untrusted authors are planned.
Deploying safely
Until per-session isolation lands:
  • Point CodeForge only at repositories where everyone with push or PR access is
trusted, and treat the host as part of that trust domain.
  • Leave code_review.allow_untrusted_authors at its default of false.
  • Give the server its own host or VM. Do not run it alongside unrelated
workloads, and never expose the Docker socket to it.
  • Pin a released image tag rather than tracking :latest, so upgrades are
deliberate.
  • Scope provider tokens to the repositories that actually need them, and rotate
them if a session ever behaves unexpectedly.
See Deployment and
Configuration for the
details.
Scope
In scope: anything letting an untrusted PR author or repository reach the
server's credentials, other sessions, or the host. Authentication and tenant
isolation bypasses. Credential leakage through logs, API responses, or the
session environment.
Out of scope: the absence of per-session sandboxing, which is documented above
and on the roadmap; issues requiring operator-level access you already hold;
and vulnerabilities in the AI CLIs themselves, which belong with their vendors.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: freema/codeforge
Security
Report a vulnerability

SECURITY.md

Security Policy
Reporting a vulnerability
Please report security issues privately, through
GitHub Security Advisories.
Do not open a public issue for anything exploitable.
CodeForge is maintained by one person, so please set expectations accordingly:
  • Acknowledgement within 7 days
  • An assessment, and a fix or a plan, within 30 days for anything confirmed
  • Credit in the advisory and release notes, unless you prefer otherwise
If you would rather not use GitHub, contact details are at
tomasgrasl.cz.
Supported versions
Only the latest minor release receives security fixes. Fixes are not
backported to earlier versions — upgrade to the current release.
VersionSupported
1.1.xYes
< 1.1No
Threat model
Running a session means executing a repository's code and letting an AI CLI
decide what else to run, with approvals disabled. Repository content is
attacker-controlled input, and prompt injection from within a repository is a
realistic path — not a theoretical one.
Current isolation: the AI CLI runs in the same container as the server,
dropped to a non-root user. That is a privilege boundary, not isolation. There
is no per-session container, VM, or network policy yet.
What the server does contain:
  • The CLI subprocess receives an allowlisted environment rather than the
server's, so the encryption key protecting the credential registry, the
operator token, webhook secrets and the Redis URL never enter a session
(internal/tool/runner/env.go).
  • Git credentials are supplied through short-lived GIT_ASKPASS scripts that
are removed before the CLI starts. Tokens never reach the URL or
.git/config.
  • Webhook-triggered work from authors without write access is refused by
default (code_review.allow_untrusted_authors).
  • Opening a pull request always requires an explicit action. This is a
hard-coded invariant, not a configuration flag.
What it does not do yet: isolate sessions from each other, from the SQLite
database on the shared filesystem, or from the network. Per-session
sandboxing, a credential-injecting model proxy, default-deny egress and a
read-only tool tier for untrusted authors are planned.
Deploying safely
Until per-session isolation lands:
  • Point CodeForge only at repositories where everyone with push or PR access is
trusted, and treat the host as part of that trust domain.
  • Leave code_review.allow_untrusted_authors at its default of false.
  • Give the server its own host or VM. Do not run it alongside unrelated
workloads, and never expose the Docker socket to it.
  • Pin a released image tag rather than tracking :latest, so upgrades are
deliberate.
  • Scope provider tokens to the repositories that actually need them, and rotate
them if a session ever behaves unexpectedly.
See Deployment and
Configuration for the
details.
Scope
In scope: anything letting an untrusted PR author or repository reach the
server's credentials, other sessions, or the host. Authentication and tenant
isolation bypasses. Credential leakage through logs, API responses, or the
session environment.
Out of scope: the absence of per-session sandboxing, which is documented above
and on the roadmap; issues requiring operator-level access you already hold;
and vulnerabilities in the AI CLIs themselves, which belong with their vendors.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Security: freema/codeforge
Security
Report a vulnerability

SECURITY.md

Security Policy
Reporting a vulnerability
Please report security issues privately, through
GitHub Security Advisories.
Do not open a public issue for anything exploitable.
CodeForge is maintained by one person, so please set expectations accordingly:
  • Acknowledgement within 7 days
  • An assessment, and a fix or a plan, within 30 days for anything confirmed
  • Credit in the advisory and release notes, unless you prefer otherwise
If you would rather not use GitHub, contact details are at
tomasgrasl.cz.
Supported versions
Only the latest minor release receives security fixes. Fixes are not
backported to earlier versions — upgrade to the current release.
VersionSupported
1.1.xYes
< 1.1No
Threat model
Running a session means executing a repository's code and letting an AI CLI
decide what else to run, with approvals disabled. Repository content is
attacker-controlled input, and prompt injection from within a repository is a
realistic path — not a theoretical one.
Current isolation: the AI CLI runs in the same container as the server,
dropped to a non-root user. That is a privilege boundary, not isolation. There
is no per-session container, VM, or network policy yet.
What the server does contain:
  • The CLI subprocess receives an allowlisted environment rather than the
server's, so the encryption key protecting the credential registry, the
operator token, webhook secrets and the Redis URL never enter a session
(internal/tool/runner/env.go).
  • Git credentials are supplied through short-lived GIT_ASKPASS scripts that
are removed before the CLI starts. Tokens never reach the URL or
.git/config.
  • Webhook-triggered work from authors without write access is refused by
default (code_review.allow_untrusted_authors).
  • Opening a pull request always requires an explicit action. This is a
hard-coded invariant, not a configuration flag.
What it does not do yet: isolate sessions from each other, from the SQLite
database on the shared filesystem, or from the network. Per-session
sandboxing, a credential-injecting model proxy, default-deny egress and a
read-only tool tier for untrusted authors are planned.
Deploying safely
Until per-session isolation lands:
  • Point CodeForge only at repositories where everyone with push or PR access is
trusted, and treat the host as part of that trust domain.
  • Leave code_review.allow_untrusted_authors at its default of false.
  • Give the server its own host or VM. Do not run it alongside unrelated
workloads, and never expose the Docker socket to it.
  • Pin a released image tag rather than tracking :latest, so upgrades are
deliberate.
  • Scope provider tokens to the repositories that actually need them, and rotate
them if a session ever behaves unexpectedly.
See Deployment and
Configuration for the
details.
Scope
In scope: anything letting an untrusted PR author or repository reach the
server's credentials, other sessions, or the host. Authentication and tenant
isolation bypasses. Credential leakage through logs, API responses, or the
session environment.
Out of scope: the absence of per-session sandboxing, which is documented above
and on the roadmap; issues requiring operator-level access you already hold;
and vulnerabilities in the AI CLIs themselves, which belong with their vendors.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: freema/codeforge
Security
Report a vulnerability

SECURITY.md

Security Policy
Reporting a vulnerability
Please report security issues privately, through
GitHub Security Advisories.
Do not open a public issue for anything exploitable.
CodeForge is maintained by one person, so please set expectations accordingly:
  • Acknowledgement within 7 days
  • An assessment, and a fix or a plan, within 30 days for anything confirmed
  • Credit in the advisory and release notes, unless you prefer otherwise
If you would rather not use GitHub, contact details are at
tomasgrasl.cz.
Supported versions
Only the latest minor release receives security fixes. Fixes are not
backported to earlier versions — upgrade to the current release.
VersionSupported
1.1.xYes
< 1.1No
Threat model
Running a session means executing a repository's code and letting an AI CLI
decide what else to run, with approvals disabled. Repository content is
attacker-controlled input, and prompt injection from within a repository is a
realistic path — not a theoretical one.
Current isolation: the AI CLI runs in the same container as the server,
dropped to a non-root user. That is a privilege boundary, not isolation. There
is no per-session container, VM, or network policy yet.
What the server does contain:
  • The CLI subprocess receives an allowlisted environment rather than the
server's, so the encryption key protecting the credential registry, the
operator token, webhook secrets and the Redis URL never enter a session
(internal/tool/runner/env.go).
  • Git credentials are supplied through short-lived GIT_ASKPASS scripts that
are removed before the CLI starts. Tokens never reach the URL or
.git/config.
  • Webhook-triggered work from authors without write access is refused by
default (code_review.allow_untrusted_authors).
  • Opening a pull request always requires an explicit action. This is a
hard-coded invariant, not a configuration flag.
What it does not do yet: isolate sessions from each other, from the SQLite
database on the shared filesystem, or from the network. Per-session
sandboxing, a credential-injecting model proxy, default-deny egress and a
read-only tool tier for untrusted authors are planned.
Deploying safely
Until per-session isolation lands:
  • Point CodeForge only at repositories where everyone with push or PR access is
trusted, and treat the host as part of that trust domain.
  • Leave code_review.allow_untrusted_authors at its default of false.
  • Give the server its own host or VM. Do not run it alongside unrelated
workloads, and never expose the Docker socket to it.
  • Pin a released image tag rather than tracking :latest, so upgrades are
deliberate.
  • Scope provider tokens to the repositories that actually need them, and rotate
them if a session ever behaves unexpectedly.
See Deployment and
Configuration for the
details.
Scope
In scope: anything letting an untrusted PR author or repository reach the
server's credentials, other sessions, or the host. Authentication and tenant
isolation bypasses. Credential leakage through logs, API responses, or the
session environment.
Out of scope: the absence of per-session sandboxing, which is documented above
and on the roadmap; issues requiring operator-level access you already hold;
and vulnerabilities in the AI CLIs themselves, which belong with their vendors.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: freema/codeforge
Security
Report a vulnerability

SECURITY.md

Security Policy
Reporting a vulnerability
Please report security issues privately, through
GitHub Security Advisories.
Do not open a public issue for anything exploitable.
CodeForge is maintained by one person, so please set expectations accordingly:
  • Acknowledgement within 7 days
  • An assessment, and a fix or a plan, within 30 days for anything confirmed
  • Credit in the advisory and release notes, unless you prefer otherwise
If you would rather not use GitHub, contact details are at
tomasgrasl.cz.
Supported versions
Only the latest minor release receives security fixes. Fixes are not
backported to earlier versions — upgrade to the current release.
VersionSupported
1.1.xYes
< 1.1No
Threat model
Running a session means executing a repository's code and letting an AI CLI
decide what else to run, with approvals disabled. Repository content is
attacker-controlled input, and prompt injection from within a repository is a
realistic path — not a theoretical one.
Current isolation: the AI CLI runs in the same container as the server,
dropped to a non-root user. That is a privilege boundary, not isolation. There
is no per-session container, VM, or network policy yet.
What the server does contain:
  • The CLI subprocess receives an allowlisted environment rather than the
server's, so the encryption key protecting the credential registry, the
operator token, webhook secrets and the Redis URL never enter a session
(internal/tool/runner/env.go).
  • Git credentials are supplied through short-lived GIT_ASKPASS scripts that
are removed before the CLI starts. Tokens never reach the URL or
.git/config.
  • Webhook-triggered work from authors without write access is refused by
default (code_review.allow_untrusted_authors).
  • Opening a pull request always requires an explicit action. This is a
hard-coded invariant, not a configuration flag.
What it does not do yet: isolate sessions from each other, from the SQLite
database on the shared filesystem, or from the network. Per-session
sandboxing, a credential-injecting model proxy, default-deny egress and a
read-only tool tier for untrusted authors are planned.
Deploying safely
Until per-session isolation lands:
  • Point CodeForge only at repositories where everyone with push or PR access is
trusted, and treat the host as part of that trust domain.
  • Leave code_review.allow_untrusted_authors at its default of false.
  • Give the server its own host or VM. Do not run it alongside unrelated
workloads, and never expose the Docker socket to it.
  • Pin a released image tag rather than tracking :latest, so upgrades are
deliberate.
  • Scope provider tokens to the repositories that actually need them, and rotate
them if a session ever behaves unexpectedly.
See Deployment and
Configuration for the
details.
Scope
In scope: anything letting an untrusted PR author or repository reach the
server's credentials, other sessions, or the host. Authentication and tenant
isolation bypasses. Credential leakage through logs, API responses, or the
session environment.
Out of scope: the absence of per-session sandboxing, which is documented above
and on the roadmap; issues requiring operator-level access you already hold;
and vulnerabilities in the AI CLIs themselves, which belong with their vendors.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Security: freema/codeforge
Security
Report a vulnerability

SECURITY.md

Security Policy
Reporting a vulnerability
Please report security issues privately, through
GitHub Security Advisories.
Do not open a public issue for anything exploitable.
CodeForge is maintained by one person, so please set expectations accordingly:
  • Acknowledgement within 7 days
  • An assessment, and a fix or a plan, within 30 days for anything confirmed
  • Credit in the advisory and release notes, unless you prefer otherwise
If you would rather not use GitHub, contact details are at
tomasgrasl.cz.
Supported versions
Only the latest minor release receives security fixes. Fixes are not
backported to earlier versions — upgrade to the current release.
VersionSupported
1.1.xYes
< 1.1No
Threat model
Running a session means executing a repository's code and letting an AI CLI
decide what else to run, with approvals disabled. Repository content is
attacker-controlled input, and prompt injection from within a repository is a
realistic path — not a theoretical one.
Current isolation: the AI CLI runs in the same container as the server,
dropped to a non-root user. That is a privilege boundary, not isolation. There
is no per-session container, VM, or network policy yet.
What the server does contain:
  • The CLI subprocess receives an allowlisted environment rather than the
server's, so the encryption key protecting the credential registry, the
operator token, webhook secrets and the Redis URL never enter a session
(internal/tool/runner/env.go).
  • Git credentials are supplied through short-lived GIT_ASKPASS scripts that
are removed before the CLI starts. Tokens never reach the URL or
.git/config.
  • Webhook-triggered work from authors without write access is refused by
default (code_review.allow_untrusted_authors).
  • Opening a pull request always requires an explicit action. This is a
hard-coded invariant, not a configuration flag.
What it does not do yet: isolate sessions from each other, from the SQLite
database on the shared filesystem, or from the network. Per-session
sandboxing, a credential-injecting model proxy, default-deny egress and a
read-only tool tier for untrusted authors are planned.
Deploying safely
Until per-session isolation lands:
  • Point CodeForge only at repositories where everyone with push or PR access is
trusted, and treat the host as part of that trust domain.
  • Leave code_review.allow_untrusted_authors at its default of false.
  • Give the server its own host or VM. Do not run it alongside unrelated
workloads, and never expose the Docker socket to it.
  • Pin a released image tag rather than tracking :latest, so upgrades are
deliberate.
  • Scope provider tokens to the repositories that actually need them, and rotate
them if a session ever behaves unexpectedly.
See Deployment and
Configuration for the
details.
Scope
In scope: anything letting an untrusted PR author or repository reach the
server's credentials, other sessions, or the host. Authentication and tenant
isolation bypasses. Credential leakage through logs, API responses, or the
session environment.
Out of scope: the absence of per-session sandboxing, which is documented above
and on the roadmap; issues requiring operator-level access you already hold;
and vulnerabilities in the AI CLIs themselves, which belong with their vendors.
 There aren't any published security advisories