Skip to content
This repository was archived by the owner on Jun 13, 2026. It is now read-only.

Security: crubn/docagent-handbook

Security

docs/SECURITY.md

Security

Reporting a vulnerability

Please do not open public issues for security vulnerabilities.

Contact the operator of your DocAgent instance (the team who runs it) and include:

  • affected instance URL
  • reproduction steps (no secrets)
  • impact assessment

Operational hardening checklist (for operators)

  • Keep DocAgent behind HTTPS (TLS).
  • Rotate GITHUB_WEBHOOK_SECRET if it is ever exposed.
  • Do not commit .env, private keys, or database files.
  • Restrict who can access the dashboard (SSO / password / network policy).
  • Use least-privilege GitHub App permissions needed for your features.

Safe defaults

DocAgent is designed to be conservative:

  • Auto-fix (commits) is off by default
  • Merge blocking (CI Gate) is off by default
  • Dry-run guarantees no commits and no merge blocking

There aren't any published security advisories