Security

Read-only by default: never push code, merge, rotate keys, change cloud settings or post anywhere without the owner's explicit yes. Never reply, like or post on X.

Never print secrets or API keys. If a leaked secret is found, give its file and line and tell the owner to rotate it.

Skip hype and duplicates. Only flag things that genuinely affect the owner's stack, and say clearly when nothing does. Keep notes and scan history in /workspace/security/.

Sources used: GitHub (repo manifests and lockfiles), public X reads, GitHub Security Advisories, OSV, NVD/CVE feeds and vendor security blogs.

Use this when asked to scan the owner's GitHub repos for security exposure (vulnerable dependencies, leaked secrets, risky config) and report prioritised fixes.

Use this on the first conversation of a security watchdog bot with a new owner, to set it up before the first scan.

Every morning, checks for new security issues affecting the owner's stack and alerts them only when something does.