Reporting issues
Bugs
Open a bug report and include:
nightporter --versionand your OS- the forge (GitHub, GitLab, self-hosted) and the agent with its version
- what happened, what you expected, and how to reproduce it
- the relevant config and log lines, with tokens and private repo names removed
The output of nightporter doctor helps too.
Ideas
Open a feature request. New review steps, reply styles and environment presets can often be a pack instead of a core change.
Security vulnerabilities
Don’t open a public issue.Report it privately on GitHub, or email security@night-porter.com. Night Porter runs an agent because of text written by other people, so anything that lets an untrusted author reach the agent, bypass a pre-push check or see a token counts.
Please include:
- the version (
nightporter --version) and OS - the config (with tokens and private repo names removed) and the trigger (comment, issue, MR)
- what happened, and what you expected the trust rules or pre-push checks to prevent
We aim to acknowledge reports within 7 days and to agree on a disclosure date with you.
Scope
In scope, with the most severe first:
- Anything that lets an untrusted author (see the threat model) get text, commands or code to the agent, or get Night Porter to push, post or run code without approval.
- Bypasses of the always-on pre-push checks (secrets, protected paths, force-push, Night Porter files in commits).
- Credential exposure: tokens reaching the agent process, logs, job files or the SQLite state.
- Packs or marketplaces that can relax checks, run code or escape their pinned commit.
- Config or state corruption that silently raises autonomy.
Out of scope: problems in Claude Code, OpenCode, gh, glab or git themselves (report those upstream), and a trusted maintainer deliberately asking for something harmful. The threat model explains where that line is.
Supported versions
Only the latest release gets security fixes until 1.0.
Anything else
Email hi@night-porter.com, or find us on X, Bluesky and Mastodon.