Community Security Update

[mrT23]

We value our community's security feedback and take all potential vulnerability reports seriously.

We recently became aware of public claims regarding an unhandled vulnerability in pr-agent.
To ensure transparency:

1. We received an initial email about a potential vulnerability
2. Our team promptly responded requesting additional details (see here)
3. No further information was provided by the reporter
4. We finally learned of the specific concerns through a public post.
5. While some of the issues raised were overstated, they highlighted areas for improvement in our infrastructure. We promptly addressed the underlying matters and implemented additional safeguards, released a new version, and announced the fixes on our readme page.
6. We tried after the publication to contact the author (Nils), but again he did not respond.
7. Worth also noting that in contrast to the blog, the reported issues are relevant only for public repositories with "PR-Agent" (the open-source project) and not "Qodo Merge", a paid product that utilizes a different configuration mechanism

If you discover a potential security vulnerability, please contact us at tal.r@qodo.ai.
We are committed to maintaining the security of our open-source community.

[IsmaelMartinez]

Thanks for keeping this on record. For anyone finding this now, please note the reporting channel has changed: use GitHub's private vulnerability reporting on this repository rather than the email above, per the current SECURITY.md. Closing as historical.