GitHub takes the security of our software products and services seriously, including the open source code repositories managed through our GitHub organizations, such as cli.
If you believe you have found a security vulnerability in GitHub CLI, report it first through GitHub's bug bounty program on HackerOne.
- Include a description of your investigation of the GitHub CLI's codebase and why you believe an exploit is possible.
- POCs and links to code are greatly encouraged.
For other security-related concerns or questions, use this repository's private GitHub Security Advisory (GHSA) reporting flow.
Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.
A dependency having a CVE does not mean gh has a vulnerability. We use govulncheck to determine whether vulnerable symbols are actually reachable from gh's code. If you are reporting a dependency CVE, please include evidence that the issue is exploitable in gh: a call chain into the affected symbols or a proof of concept. Reports that only list a dependency version and CVE without demonstrating impact will be closed.
Thanks for helping make GitHub safe for everyone.