Security Guarantees & Responsible Disclosure
ContribLens adheres to a strict non-negotiable safety invariant:Code verifies. AI explains. Human approves.
1. Code Verifies
Vulnerabilities and security risks are detected solely by deterministic AST/manifest parsers and official OSV.dev advisories.
2. AI Explains
Gemma 4 31B and Gemini translate validated evidence into beginner-friendly guidance. AI cannot invent CVEs or inflate severities.
3. Human Approves
No automatic pull requests or public issue spam. Maintainers review, verify, and publish issue drafts manually.
Repository Scanning Scope & Safety Boundaries
- Public GitHub repositories accessible over HTTPS.
- Dependency manifests (package.json, lockfiles, requirements.txt, pyproject.toml).
- CI/CD workflows (.github/workflows/*.yml) for permission misconfigurations.
- Community governance health files (SECURITY.md, LICENSE, README, CONTRIBUTING.md).
- Bounded text/configuration files strictly under 60 files, 180 KB per file, and 15 MB total.
- Never executes repository code or shell scripts.
- Never runs package managers (npm install, pip install).
- Never scans private repositories without explicit user credentials.
- Never submits public pull requests or issues automatically.
- Never logs or transmits unmasked secrets or credentials.
Responsible Disclosure Guard (SECURITY.md §4)
When ContribLens detects high-confidence exposed secrets or critical unpatched RCE vulnerabilities, it automatically invokes the Disclosure Guard: public issue drafts are BLOCKED with HTTP 403 DISCLOSURE_BLOCKED. Instead, the contributor is provided with private security disclosure instructions and maintainer security contact details to prevent accidental public disclosure.
Reporting Vulnerabilities in ContribLens
If you discover a security vulnerability in ContribLens itself, please report it via private email only (never public issues) to security@contriblens.org. We acknowledge receipt within 48 hours and coordinate responsible disclosure.
© 2026 ContribLens. Code verifies. AI explains. Human approves.