/security
Security model.
<?php$page = ["posture" => defensive only,"repo_content" => data, never instruction,"webhooks" => HMAC-SHA256,"exploits" => never generated,];
Repository content
Parsed by fixed regexes and a strict schema. Never executed, never sent to a model, never rendered as HTML. A README saying “ignore previous instructions” changes nothing (tested).
Advisory text
Control characters stripped, length capped, rendered as plain text. Raw hash stored so changes are detectable.
Webhooks
HMAC-SHA256 over the raw body with constant-time comparison before JSON is parsed. Only patch-agent/* branches are acted on.
Writes to GitHub
Only after installation + policy + validator. New branch only, never the default branch. One flag disables all writes.
Defensive-only operation
The system produces version updates for repositories that opted in. It has no endpoint, model prompt or code path that generates exploits, payloads or proofs of concept, and it does not scan hosts, URLs or networks.
Authorization model
A write requires a GitHub App installation on the specific repository. A .patchbot policy can only narrow what is allowed, never widen it. Removing the App immediately revokes access.
No unsolicited pull requests. No pushes to default branches.
Repository trust boundary
All repository content (README, issues, comments, source, package metadata, commit messages) is untrusted data. It is parsed by deterministic code with fixed regular expressions and schemas, not passed to a model as instructions.
The .patchbot schema is strict: unknown keys are rejected and there is no field that accepts a command.
AI safety
Version remediation in phase 1 is deterministic code, so no model output reaches a repository. If model-assisted patches are added, their output goes through the same file allowlist, diff-size, secret and dangerous-content checks, and requires CI plus human review by default.
Secret handling
The GitHub App private key and webhook secret live only in server environment variables and are never sent to the browser. Installation tokens are short-lived and scoped to one installation.
The treasury is configured with a public address only. No signing key exists in this codebase or deployment.
Webhook validation
Every GitHub webhook is verified with HMAC-SHA256 (X-Hub-Signature-256) using a constant-time comparison. Unsigned or mis-signed requests are rejected with 401 before parsing.
Patch isolation
No repository code runs on this server. Tests run in the target repository's own CI on the PR branch. A future dedicated runner must be ephemeral, with no host filesystem access, no production secrets, no wallet keys, egress restricted to package registries, CPU, memory and time limits, and destruction after each run.
Responsible disclosure
Report vulnerabilities in this project to . Please include reproduction steps and allow reasonable time for a fix before public disclosure. We do not pursue good-faith researchers.