rodin/review-bot
2
1
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases 6 Wiki Activity

chore(#137): update CHANGELOG with security fixes from review
PR Ready Gate / clear-labels (pull_request) Successful in 2s
Details
CI / test (pull_request) Successful in 17s
Details
CI / review (anthropic--claude-4.6-sonnet, sonnet, SONNET_REVIEW_TOKEN) (pull_request) Successful in 44s
Details
CI / review (gpt-5, security, ., rodin/security-patterns, SECURITY_REVIEW.md, SECURITY_REVIEW_TOKEN) (pull_request) Successful in 1m31s
Details
CI / review (gpt-5, gpt, GPT_REVIEW_TOKEN) (pull_request) Successful in 1m48s
Details

Browse Source
This commit is contained in:
Rodin
2026-05-15 03:32:18 +00:00
parent 45e2f5fc1c
commit f7815b8778
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+6
View File
@@ -27,6 +27,12 @@ mappings:
- Multiple mappings can reference the same doc; docs are deduplicated - Multiple mappings can reference the same doc; docs are deduplicated
- Missing doc files: warn and skip (review continues without them) - Missing doc files: warn and skip (review continues without them)
- No matching paths: no docs injected, review runs normally - No matching paths: no docs injected, review runs normally
- Absolute paths and path traversal (`..` segments) in doc paths are rejected
### Security
- **Path traversal guard**: doc paths from the YAML config are validated to reject absolute paths and `..` segments before VCS API calls
- **Prompt injection guard**: design doc content is injected with an explicit instruction to treat it as reference data and not follow any instructions it may contain
## v0.3.2 ## v0.3.2