Security Overview

git-lrc Security

This document answers security and procurement questions for git-lrc in concrete terms.

Source: git-lrc Security.

Quick Answers Permalink for this section

• Vulnerability reports: use GitHub private security reporting first; use shrijith@hexmos.com if GitHub reporting is not possible.
• Response time: acknowledgement within 2 business days; for internally confirmed findings, triage and remediation work starts within 7 calendar days.
• Default behavior: git-lrc runs locally as a CLI.
• Code leaves the machine only when you submit a review or run setup/update operations that call remote APIs.
• Review submission sends staged diff bundle data to the configured LiveReview API.
• Local files include configuration at ~/.lrc.toml and repository-local state under .git/lrc.
• Security scans: gitleaks, OSV scanner, govulncheck, and Semgrep run in GitHub Actions.
• SBOM is generated and attached to release assets.