| Version | Supported |
|---|---|
| 2.3.x | Yes |
| < 2.3 | No |
Do not open a public GitHub issue. Use GitHub private vulnerability reporting (the "Report a vulnerability" button under the repository's Security tab). Include a description, steps to reproduce, the likely impact and a suggested fix if you have one.
We aim to acknowledge reports within 48 hours and to release a fix for critical issues within 7 days.
code-review-graph is a local development tool. It:
- runs as a local MCP server over stdio, or over Streamable HTTP bound to localhost with
serve --http; - stores data in a local SQLite database (
.code-review-graph/graph.db); - makes no network calls during graph builds, updates and reviews;
- reads source files only under the validated repository root.
| Vector | Mitigation |
|---|---|
| SQL injection | All queries use parameterised ? placeholders |
| Path traversal | _validate_repo_root() requires an existing directory containing .git, .svn or .code-review-graph |
| Prompt injection | _sanitize_name() strips control characters and caps names at 256 characters |
| XSS (visualization) | escH() escapes HTML entities; </script> is escaped inside embedded JSON |
| Subprocess injection | No shell=True; git and svn are invoked with argument lists |
DNS rebinding (serve --http) |
http_origin_guard.py validates the Host and Origin headers |
| Supply chain | Dependencies pinned with upper bounds; uv.lock records SHA256 hashes |
| CDN tampering | D3.js is bundled and loaded with a Subresource Integrity hash; the CDN fallback carries the same hash |
| API key leakage | Cloud embedding credentials are read from environment variables only |
- Cloud embeddings: only when an OpenAI-compatible, Google Gemini, MiniMax or Voyage AI provider is configured. Cloud providers print an egress warning unless
CRG_ACCEPT_CLOUD_EMBEDDINGS=1is set. - Local embedding model:
sentence-transformersdownloads the model from Hugging Face on first use. - D3.js: the visualization HTML loads the D3 v7 copy shipped with the package (same origin, SRI-verified) and falls back to the
d3js.orgCDN (also SRI-verified,crossorigin="anonymous") only if the local copy is unavailable.
CI runs bandit, ruff and mypy on every pull request. Bandit exemptions are listed in pyproject.toml with a reason for each.