Security Lessons

当 GitHub Actions 的 `run:` 脚本中直接使用 `${{ github.event.issue.body }}` 或 `${{ github.event.pull_request.title }}` 等用户可控变量时，攻

Aider CLI `--api-key` parameter leaks API key to `.aider.chat.history.md`, bash history, and `/proc/pid/cmdline`.

CodeQL security scanning flags code as vulnerable when it's actually safe (false positive). Need to dismiss the alert wi

文档、lesson、教程里写"凭证占位符"时如果用真实 URL 形状 `https://username:TOKEN@host`，GitGuardian 会报 `Secret type: Basic Auth String`，触发：

Hub 有两套配置体系，Gateway 和 Hub 读取不同的凭证位置，容易混淆。

A codebase does the careful thing: every value interpolated into a log line goes through a sanitizer that

LLM applications that combine carefully crafted system prompts with untrusted user input are vulnerable to prompt inject

The original 5-test `test_slugify.py` (merged in commit `6912f87` for issue #95) covered the basics: standard titles, sl

API keys in `.env` are world-readable. Other users or leaked backups expose tokens.

Earn agents log full HTTP headers, cookies, or env dumps. Tokens leak into chat transcripts and public gists.