All pull requests

Pull requests

• fix: Reachable remediation batch (x/text, handlers)

  #43·al1dazzi opened Sep 8, 2026Collaborator·

  ·
  2

• Remediate selected AI/DLP/SSRF sinks and pin golang.org/x/text

  #42·al1dazzi opened Sep 8, 2026Collaborator·

  ·
  5

• fix: remediate selected Reachable AI/DLP/SSRF and x/text batch

  #41·al1dazzi opened Sep 8, 2026Collaborator·

  ·
  3

• Remediate selected Reachable AI/DLP/SSRF and x/text findings

  #40·al1dazzi opened Sep 8, 2026Collaborator·

  ·
  4

• Reachable remediation proof

  #39·github-actions[bot] opened Jul 9, 2026Bot·

  ·

• Reachable remediation proof

  #38·github-actions[bot] opened Jul 9, 2026Bot·

  ·

• Reachable remediation proof

  #37·github-actions[bot] opened Jul 9, 2026Bot·

  ·

• Remediate hardcoded GitHub PAT in internal/handlers/secrets.go via runtime secret loading

  reachable-copilot-verification-failed
  #36·al1dazzi with CopilotAI opened Jul 9, 2026·

  ·
  

• Harden handler URL fetching and error responses for Reachable shard 4 (CWE-319/918 + error disclosure)

  #35·al1dazzi with CopilotAI opened Jul 9, 2026·

  ·
  

• fix(security): remediate OS command injection in DiagnosticPing (CWE-78)

  #34·al1dazzi with CopilotAI opened Jul 9, 2026·

  ·
  

• fix: redact PII from logs/HTTP and isolate user input from LLM instructions

  #33·al1dazzi with CopilotAI opened Jul 9, 2026·

  ·
  

• fix: upgrade golang.org/x/text v0.3.7 → v0.3.8 (CVE-2022-32149)

  #32·al1dazzi with CopilotAI opened Jul 9, 2026·

  ·
  

• Remove hardcoded GitHub PAT from secret handler

  #31·al1dazzi with CopilotAI opened Jun 23, 2026·

  ·
  

• Fix SSRF, CWE-319, error-leak, and taint-flow in FetchTool handler

  #30·al1dazzi with CopilotAI opened Jun 23, 2026·

  ·
  

• fix(security): remediate OS command injection in DiagnosticPing

  #29·al1dazzi with CopilotAI opened Jun 23, 2026·

  ·
  

• Harden AI prompt handling and redact DLP telemetry in targeted handlers

  #28·al1dazzi with CopilotAI opened Jun 23, 2026·

  ·
  

• Upgrade golang.org/x/text v0.3.7 → v0.3.8 to fix CVE-2022-32149

  #27·al1dazzi with CopilotAI opened Jun 23, 2026·

  ·
  

• fix(secrets): remove hardcoded GitHub PAT, read token from env at runtime

  #26·al1dazzi with CopilotAI opened Jun 22, 2026·

  ·
  

• fix: isolate LLM user input and redact PII from logs/HTTP payloads

  #25·al1dazzi with CopilotAI opened Jun 22, 2026·

  ·
  

• fix: upgrade golang.org/x/text v0.3.7 → v0.3.8 (CVE-2022-32149)

  #24·al1dazzi with CopilotAI opened Jun 22, 2026·

  ·
  

• security: fix SSRF, cleartext fetch, error disclosure, and tainted URL flow in handlers

  #23·al1dazzi with CopilotAI opened Jun 22, 2026·

  ·
  

• Fix OS command injection in DiagnosticPing (RCH-RULE-877450ee, RCH-RULE-a755ac83, RCH-RULE-7059753c)

  #22·al1dazzi with CopilotAI opened Jun 22, 2026·

  ·
  

• fix: remediate 13 reachable security findings (cmdi, SSRF, LLM PII, DLP, secret, error-leak, CVE)

  #21·al1dazzi with CopilotAI opened Jun 22, 2026·

  ·
  

• Remediate reachable critical batch: command injection, SSRF/TLS, secret exposure, PII leakage, and x/text CVE

  #20·al1dazzi with CopilotAI opened Jun 22, 2026·

  ·
  

• fix: remediate 13 reachable security findings (cmdi, SSRF, PII, secret, error-leak, vuln-dep)

  #19·al1dazzi with CopilotAI opened Jun 22, 2026·

  ·