8e24cf48df
- brain-context-load called 'gbrain list_pages' (an MCP tool name), so every skill's brain context was 0 bytes. It now uses 'gbrain list' with gbrain's real filter flags, and prints one line when queries fail. - The code-stage sync always passes --no-pull (managed gbrain >= 0.51 refuses without it); a gbrain that rejects the flag fails with an upgrade message and is never retried without it. stderr is streamed with a bounded tail and quoted in failure summaries. - /sync-gbrain gains --sources (and GSTACK_MEMORY_INGEST_SOURCES); by default it skips types already synced through a federated curated source, so curated pages stop being re-duplicated. Co-authored-by: Vitor Cepeda Lopes <vitor@vitorcepedalopes.com> Co-authored-by: harshitgavita-07 <harshit.gavita@gmail.com>
1.3 KiB
Security Policy
Reporting a vulnerability
Please report security vulnerabilities privately, not in public issues, pull requests, or discussions.
Preferred: use GitHub private vulnerability reporting: https://github.com/garrytan/gstack/security/advisories/new
Include what you can: the affected file, skill, or command; the gstack
version (cat VERSION in your install, or the /gstack-upgrade output);
steps to reproduce; and the impact you observed.
If that link does not work: open a minimal public issue titled "Request for a private security contact". Do not include any technical details, affected files, or proof of concept in it. A maintainer will reply with a private channel, and you can send the details there.
Scope
gstack is a set of skills, scripts, and helper binaries that run on your own
machine with your own credentials. Reports about the code in this repository
are in scope: the skill templates and generated SKILL.md files, bin/,
lib/, browse/, scripts/, the installer (setup), and the GitHub Actions
workflows. Vulnerabilities in third-party tools gstack drives (Claude Code,
Codex, gbrain, scanners, browsers) should go to those projects.
Supported versions
Fixes land on main and ship in the next release. Run /gstack-upgrade to
get them; older versions are not patched separately.