ARGUS takes security seriously. As a GitHub Action executing code review pipelines and handling sensitive pull request data, we strictly enforce security guidelines and secrets protection.

Only the latest release and active development branch receive security updates and vulnerability patches.

If you discover a potential security vulnerability or secret leakage issue within ARGUS, please report it immediately to our security contact rather than opening a public issue.

• Email: contact@sahooshuvranshu.is-a.dev

Please include the following details in your report:

1. Description of the vulnerability or secret handling issue.
2. Steps to reproduce the issue (including sample workflow configs or PR payloads if applicable).
3. Impact assessment and suggested resolution.

We will acknowledge receipt of your vulnerability report within 24–48 hours and work with you to patch and disclose the issue responsibly.

• No Secrets Exposure: ARGUS agents are strictly forbidden from outputting API keys, tokens, or environment credentials into GitHub PR comments or workflow logs.
• Scope Restriction: ARGUS only processes files modified within the pull request diff and does not access external private assets without explicit workflow authorization.