Code Mower coordinates local CLIs, GitHub workflows, optional hosted reviewers, and optional cloud metadata upload. Treat it as automation that can read code, run configured tools, and post back to GitHub when explicitly configured.

Security fixes target the latest published 1.x release and main. Users should upgrade to the newest patch release before reporting a vulnerability that may already be fixed.

Please do not open a public issue with exploit details, credentials, private repository URLs, raw audit prompts, raw reviewer outputs, proprietary code, or secrets.

Report security concerns through GitHub private vulnerability reporting when available, or contact the maintainers out of band.

Good reports include:

• affected version or commit;
• command or workflow used;
• whether the issue involves local CLI execution, GitHub permissions, provider output, cloud export/upload, generated files, or hosted dashboard behavior;
• the smallest sanitized reproduction you can provide;
• whether source code, diffs, transcripts, tokens, provider auth output, or private keys may have been exposed; and
• suggested severity if you have one.

• Code Mower's local CLI wrappers can send prompts, diffs, and selected context files to the provider behind the configured CLI.
• SaaS reviewer lanes can expose pull request diffs and repository context to the configured GitHub App or hosted reviewer.
• Local model lanes expose code to the configured endpoint; local endpoints can keep code local, remote endpoints cannot.
• Cloud bundle/export commands are opt-in and produce inspectable artifacts before upload.
• Hosted Slack is opt-in. The v1.5.0 app is limited to one private workspace, exact member/repository/private-channel bindings, and the bot commands scope; it has no message-history, posting, file, email, event-subscription, or organization-wide permission.
• Slack command/modal text and routing identifiers cross from Slack to the hosted service. They may cross to the authorized supervisor/provider only after current policy and spend caps pass. Slack never grants provider, review, approval, or merge authority.
• OAuth codes/tokens, signing secrets, response URLs, trigger IDs, Slack identifiers, private mappings, and request bodies must not enter application logs, traces, diagnostics, Board, cloud exports, fixtures, or public reports. The dedicated OAuth relay must scrub callback queries before application handoff and run without request logging or customer-zone analytics.
• Default cloud export and upload paths must not include source code, raw diffs, raw model transcripts, raw stdout/stderr, auth probe output, or secrets.
• Generated GitHub workflows should use least-privilege tokens and should keep paid or hosted lanes manual or explicitly labeled until calibrated.

If you find a default path that leaks source, raw diffs, raw transcripts, auth output, secrets, Slack request content/routing data, or an OAuth callback query, treat it as a security issue.

Before broad public release, maintainers should run:

python scripts/privacy_scan.py
python -m unittest discover -s tests
python -m compileall -q src scripts
python scripts/smoke_easy_mode.py --json
python scripts/fresh_clone_rehearsal.py --repo-url . --ref HEAD --python python3.12 --json

The public CI workflow includes a Privacy scan step that runs python scripts/privacy_scan.py. That step exits non-zero when it finds personal paths, private repo slugs, raw auth output patterns, or likely secrets, and release/publish work must not proceed from a failing CI run.

For manual releases outside GitHub Actions, maintainers must run the same command locally and inspect any changed calibration artifacts before tagging. Only maintainers with release authority may override the scan, and overrides must be documented in the release notes with the exact reason the finding is safe to publish.