GitForms Claude Code Plugin follows security best practices and Anthropic's security requirements for Claude Code plugins.

• ✅ Zero persistent credentials - Plugin does not store GitHub tokens
• ✅ User authorization required - Every operation requires user consent
• ✅ Session-based tokens - Tokens obtained via OAuth flow per session
• ✅ No hardcoded secrets - All sensitive data via user configuration

• ✅ Read-only by default - Plugin only reads configuration
• ✅ Write operations gated - GitHub Issues creation requires user approval
• ✅ No arbitrary code execution - Plugin does not execute user-provided code
• ✅ No file system access - Operations limited to Claude Code sandbox

User Form Submission → GitHub Issues API → Validated by GitHub Actions
                ↓
         User Authorization Required
                ↓
         Claude Plugin (Read-only)
                ↓
         Analysis & Insights

• GitHub Personal Access Token (PAT) via user configuration
• Token scopes required: repo (for creating issues)
• Token stored in Claude Code settings (encrypted by Claude)

• OAuth 2.0 flow with GitHub
• Explicit user consent for each repository
• Token refresh mechanism
• Automatic token revocation on plugin uninstall

// Before any GitHub API call
if (!userHasAuthorizedRepo(repo)) {
  return askUserPermission(`Allow GitForms to access ${repo}?`);
}

Risk: Plugin accesses repositories without user consent Mitigation:

• User must explicitly configure gitforms_repo setting
• OAuth flow will require per-repository authorization
• No wildcard or automatic repository discovery

Risk: GitHub token exposed in logs or errors Mitigation:

• Tokens never logged or displayed
• Error messages sanitized (no token in stack traces)
• Claude Code handles token encryption

Risk: Spam or malicious data injected via forms Mitigation:

• Server-side validation via GitHub Actions
• Rate limiting (10 submissions/hour default)
• Honeypot fields for bot detection
• User can review all submissions before processing

Risk: Malicious scripts in form data Mitigation:

• GitHub Issues automatically sanitizes HTML
• Plugin displays data as plain text only
• No direct HTML rendering of user input

Risk: SQL/Command injection via form fields Mitigation:

• No database (GitHub Issues backend)
• No command execution with user input
• All API calls use parameterized requests

• ✅ Repository name format validation (owner/repo)
• ✅ Branch name sanitization
• ✅ Email format validation
• ✅ Field name whitelisting

• ✅ GitHub API responses validated
• ✅ User data displayed as plain text
• ✅ No eval() or dangerous functions

• ✅ HTTPS-only communication (GitHub API)
• ✅ No third-party API calls
• ✅ Rate limiting on API requests

• ✅ No telemetry or tracking
• ✅ No data sent to external services (only GitHub)
• ✅ User controls all data (GitHub repository owner)

• No credential storage (session-based only)
• User authorization required for all write operations
• Sandbox-safe (no file system access outside Claude sandbox)
• Input validation on all user inputs
• Output sanitization
• HTTPS-only communication
• No arbitrary code execution
• Error messages sanitized (no sensitive data)
• Rate limiting implemented
• OAuth 2.0 flow (planned v1.1.0)
• Security audit by third party (planned before official release)

If you discover a security vulnerability, please:

1. DO NOT open a public GitHub issue
2. Email: l.greco77@gmail.com with subject "SECURITY: GitForms Plugin"
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

• Acknowledgment: Within 24 hours
• Initial assessment: Within 72 hours
• Fix released: Within 7 days (critical issues)
• Public disclosure: After fix is released (coordinated)

Currently no formal bug bounty program. Security researchers will be credited in:

• SECURITY.md (this file)
• CHANGELOG.md
• GitHub security advisory

• ✅ No personal data collected by plugin
• ✅ User controls all data (GitHub repository)
• ✅ Right to erasure (delete GitHub Issues)
• ✅ Data portability (export via /list-contacts)
• ✅ Transparent data processing (documented)

• GitHub (data storage) is SOC 2 Type II certified
• Plugin inherits GitHub's compliance posture
• No additional data storage by plugin

• v1.0.0 (2026-01-16): Initial release with PAT authentication
• v1.1.0 (planned): OAuth 2.0 implementation
• v1.2.0 (planned): Third-party security audit

None yet (initial release)

• All changes reviewed before merge
• Security-focused code review checklist
• Dependency vulnerability scanning (npm audit)

• Minimal dependencies (reduce attack surface)
• Regular dependency updates
• Automated vulnerability scanning (Dependabot)

• Unit tests for all security-critical functions
• Integration tests with mock GitHub API
• Manual security testing before releases

• GitHub Security Best Practices
• Claude Code Security Model
• OWASP Top 10

• Anthropic Security Guidelines
• GitHub API Security
• OAuth 2.0 Best Practices

Last Updated: 2026-01-16 Version: 1.0.0 Contact: l.greco77@gmail.com