ReviewGuard MCP is a safety boundary between AI agents and a write-enabled GitHub token. Reports about anything that lets an agent bypass a gate are especially valuable: submitting without --allow-submit, removing the fixed disclaimer, escaping the --repo/--pr scope, or resolving other users' threads.

Only the latest released version receives security fixes.

Please do not open a public issue for vulnerabilities. Instead, use GitHub's private vulnerability reporting:

1. Go to the repository's Security tab.
2. Choose Report a vulnerability.
3. Describe the issue, affected configuration (flags, transport), and reproduction steps.

We will acknowledge the report, keep you informed of progress, and credit you in the advisory unless you prefer otherwise.