Stored only as a GitHub issue. Rendered as escaped text. Never placed into an agent prompt.
Threat model v1
Assume every input
is trying to escape.
Agents, issue bodies, forks, dependencies, and generated artifacts are all untrusted until a narrow boundary proves otherwise. No single “anti-stealing algorithm” is enough; the defense is layered.
Schema, size, content, injection, and prohibited-purpose checks return explicit reason codes.
Links, code, mentions, markup, and instruction-shaped text are removed into a typed JSON brief.
The daily agent receives only the winner brief in an isolated worktree with no participant credentials.
Nothing useful to steal
- No Commons passwords or participant OAuth tokens.
- Fork CI receives no repository secrets.
- Scheduled selection uses the short-lived GitHub workflow token.
- Deployment credentials are environment-scoped and unavailable to builds.
Text stays data
- No
pull_request_targetcode checkout. - No proposal-provided commands, actions, URLs, or dependencies execute.
- Workflow dependencies are pinned.
- Generated projects begin without network access or secrets.
Leak and boundary checks
- A repository-wide secret-pattern scan runs in CI.
- CODEOWNERS routes workflows, policy, and security scripts to maintainers.
- Winner selection is deterministic and emits an audit record.
- Every denial has a machine-readable policy code.
Fail closed
- Ambiguous proposals remain in review and cannot win.
- Malformed API data becomes an empty board.
- Selection is idempotent per round.
- Security reports use private GitHub advisories, not public issues.
Important limitation
Automated filtering reduces risk; it does not prove intent. Maintainers may block, pause, or remove any proposal or contribution. The build agent must continue treating every string inside a winner brief as quoted problem data—not authority to change its permissions, read credentials, or contact third parties.