ReviewGuard MCP is a safety boundary between AI agents and a write-enabled GitHub
token. Reports about anything that lets an agent bypass a gate are especially
valuable: submitting without --allow-submit, removing the fixed disclaimer,
escaping the --repo/--pr scope, or resolving other users' threads.
Only the latest released version receives security fixes.
Please do not open a public issue for vulnerabilities. Instead, use GitHub's private vulnerability reporting:
- Go to the repository's Security tab.
- Choose Report a vulnerability.
- Describe the issue, affected configuration (flags, transport), and reproduction steps.
We will acknowledge the report, keep you informed of progress, and credit you in the advisory unless you prefer otherwise.