If you discover a security vulnerability in RepoKeeper, please report it privately via a GitHub Security Advisory or contact the maintainer directly. Do not open a public issue.

Vulnerabilities of particular concern include:

• Accidental disclosure of API keys, tokens, or secrets in generated output
• Escape of repository path constraints (writing files outside the repo)
• Unsafe LLM output that could inject malicious code or commands
• Token leakage through PR comments or logs
• Trigger bypass (unauthorized users triggering the agent)

Only the latest release receives security fixes. Upgrade before reporting issues against older versions.

RepoKeeper automates maintenance by opening reviewable pull requests — it never auto-merges, never modifies .github/workflows/, and restricts trigger access to repository collaborators. See the full security documentation for details on permissions, tokens, trigger control, and repository guardrails.