The most recent 1.x release receives security fixes. Older versions do not.

Report vulnerabilities privately through GitHub's private vulnerability reporting. Please do not open a public issue for a security problem.

Include the affected version, the Forgejo version you were talking to, and the smallest reproduction you have. If a report involves a real host, redact its name and any token before sending.

This CLI holds Forgejo API credentials and talks to self-hosted forges, so the protections most worth reporting against are:

• Token disclosure. Token configuration and handling are defined in the configuration contract: tokens may come from environment variables or the HOME-relative hosts file, but are never accepted as command-line values or emitted in output, including errors and diagnostics. A path that prints or logs a token is a vulnerability.
• Token scope crossing. Host keys hex-encode punctuation so that forgejo.example resolves to FORGEJO_TOKEN_FORGEJO_2E_EXAMPLE and cannot collide with a look-alike host. A case where one host's token reaches another host is a vulnerability.
• Base URL and redirect handling. Credentials, query strings, fragments, encoded separators, and dot segments are rejected in base URLs. Plaintext HTTP is restricted to loopback whether or not a token is configured. Redirects are followed only when they stay same-origin. A bypass of any of these is a vulnerability.
• Merge safety. pr merge sends Forgejo's atomic head_commit_id so a merge cannot land on a head the caller did not verify. A path that merges without that guarantee is a vulnerability.

Reports that a command reads FORGEJO_TOKEN from the environment, or that a token appears in your own shell history, describe intended behavior rather than a vulnerability.