If you find a vulnerability in PR Lens, in the packages here, in the GitHub App, or in prlens.dev, email hello@coldtea.ai and put "PR Lens security" in the subject line. Please do not open a public issue for it: an issue is read by everyone before it is read by us.

Tell us what you found, how to reproduce it, and what it lets an attacker do. We answer every report, and we will tell you when it is fixed.

The privacy policy says what the hosted parts store and where, which is usually the first thing a reviewer wants to know.