Only the latest 0.22.x release receives security fixes.

Use GitHub private vulnerability reporting. Do not open a public issue containing vulnerability details, credentials, private repository content, or Review Bridge store data.

If private reporting is unavailable, contact the maintainer through the GitHub profile without including sensitive details and request a private reporting channel.

Useful reports include affected versions, impact, reproduction steps, and a minimal proof of concept with secrets and proprietary code removed.

Review Bridge provides workflow attestations, not a Git or GitHub security boundary. Its sensitive surfaces include snapshot integrity, repository path validation, author/reviewer capability separation, private store permissions, and release archive contents.

The selected reviewer client may send source returned by Review Bridge tools to its model provider. Apply the relevant account and organization data policy before reviewing confidential code.