CodeWhale BotandClaude Opus 5.5
59e941a511
Hunter moved the Codewhale repositories to github.com/codewhale-hq on 2026-10-05. Rewrite Hmbown/<moved repo> slugs to codewhale-hq/<repo> in docs, READMEs (all 19), website, CHANGELOGs, workflows, issue templates, Cargo/npm/VS Code/nix/winget metadata, install and updater code, the bundled first-party marketplace catalog and their tests: 1,795 references in 434 files, plus four escaped regex literals. Docker images publish to ghcr.io/codewhale-hq/codewhale from the next release. Old URLs keep working through GitHub's transfer redirects (verified live: API releases/latest, HTML releases/latest, release asset downloads, codeload tarballs, git clone), so released clients keep updating. Left unchanged on purpose: Hmbown/codewhale-cu-plugin (not moved yet; its shipped updater refuses redirects), Hmbown/deepseek-skills, cwc and other repos that did not move; package identities (winget Hmbown.CodeWhale, NSIS publisher); vendor/codewhale-ratatui (frozen reviewed package); and the extension-host GitHub adapter with tools/github/report.rs and their parity fixture, which need a bundle rebuild and move together in a follow-up. README translation stamps updated to the new README.md hash. Validation: npm test (wrapper 101/0, SDK 19/0, extension host 398 passed / 0 failed / 7 skipped, web 763/0) and npm run check:web exit 0 (one pre-existing facts-lib.mjs lint warning). cargo check --workspace --tests --all-features --locked: exit 0. cargo test -p codewhale-cli -p codewhale-release -p codewhale-protocol and the touched codewhale-tui modules (client, cloud_dispatch, commands, dispatch_runner, llm_client::mock, oauth, operate, plugins::marketplace, remote_control, remote_setup, tools::mcp_registry, tools::web::fetch, working_set, tui::ui::tests): all ok, 0 failed. check-readme-translations (18 in sync), readme locales, TUI locale parity, product vocabulary, web locales, contributor credit, plugin claims, release-workflows.test.js and check-versions all pass. Co-Authored-By: Claude Opus 5.5 <[email protected]> Signed-off-by: CodeWhale Bot <[email protected]>
1.6 KiB
Security policy
Supported versions
Security fixes target the latest published stable Codewhale release. Please upgrade before reproducing a report when possible.
| Version | Security fixes |
|---|---|
| Latest published stable release | Supported |
| Earlier releases | Upgrade to the latest stable release |
| Unreleased branches and development builds | Best effort; no release support commitment |
Report a vulnerability privately
Use GitHub's private vulnerability report form. Private vulnerability reporting is enabled for this repository. GitHub sends the report to repository maintainers through a private security advisory. Do not open a public issue or pull request containing an unpatched vulnerability or exploit details.
Include the affected version or commit, operating system, a minimal reproduction, expected and observed behavior, and the security impact. Remove credentials, tokens, provider keys, personal data, and unrelated repository contents. If a credential was exposed, rotate it through its provider before sharing a redacted reproduction.
What to expect
Maintainers review reports and discuss reproduction, impact, and remediation in the private advisory. Response and fix times depend on severity and available capacity; there is no guaranteed response deadline. Please keep exploit details private while a fix and disclosure timing are discussed. When a fix is ready, maintainers use the advisory to coordinate publication and affected versions. Reports that are ordinary bugs may be redirected to the public issue tracker after sensitive details are removed.