Reporting issues

Bugs

Open a bug report and include:

• nightporter --version and your OS
• the forge (GitHub, GitLab, self-hosted) and the agent with its version
• what happened, what you expected, and how to reproduce it
• the relevant config and log lines, with tokens and private repo names removed

The output of nightporter doctor helps too.

Ideas

Open a feature request. New review steps, reply styles and environment presets can often be a pack instead of a core change.

Security vulnerabilities

Don’t open a public issue.Report it privately on GitHub. Night Porter runs an agent because of text written by other people, so anything that lets an untrusted author reach the agent, bypass a pre-push check or see a token counts.

Please include:

• the version (nightporter --version) and OS
• the config (with tokens and private repo names removed) and the trigger (comment, issue, MR)
• what happened, and what you expected the trust rules or pre-push checks to prevent

We aim to acknowledge reports within 7 days and to agree on a disclosure date with you.

Scope

In scope, with the most severe first:

1. Anything that lets an untrusted author (see docs/threat-model.md) get text, commands or code to the agent, or get Night Porter to push, post or run code without approval.
2. Bypasses of the always-on pre-push checks (secrets, protected paths, force-push, Night Porter files in commits).
3. Credential exposure: tokens reaching the agent process, logs, job files or the SQLite state.
4. Packs or marketplaces that can relax checks, run code or escape their pinned commit.
5. Config or state corruption that silently raises autonomy.

Out of scope: problems in Claude Code, OpenCode, gh, glab or git themselves (report those upstream), and a trusted maintainer deliberately asking for something harmful. The threat model explains where that line is.

Supported versions

Only the latest release gets security fixes until 1.0.