Report security issues privately using GitHub's private vulnerability reporting: open the repository's Security tab and click Report a vulnerability. This opens a private GitHub Security Advisory visible only to maintainers.
Please do not open a public issue for security matters.
Only the latest release is supported. Cockpit ships as a Homebrew formula and
has no self-update path, so run brew upgrade cockpit (or
pipx upgrade cmux-cockpit) and re-check before reporting — the issue may
already be fixed.
| Version | Supported |
|---|---|
| Latest | Yes |
Cockpit mostly reads: git, GitHub, and your terminal backend. The one place it
acts on your behalf is auto-review, and that's the risk surface that matters —
review_prs: true spawns a Bash-capable Claude session per coworker PR, and a
PR's title, description, and diff are attacker-controlled when the PR comes from
outside your team.
Two per-repo gates guard that, both defaulting to false
(docs/config.md):
review_prs— auto-review is off entirely until you turn it on.review_external— with auto-review on, this decides whether it also reaches PRs from non-collaborators. Leave it off unless you accept exposing fork-PR content to an auto-spawned agent.
Auto-review is dry-run: it never auto-posts comments or submits an approve/request-changes verdict. A human authorizes any of that.