Security & Verification

Keep GOOGLE_GENERATIVE_AI_API_KEY and GITHUB_TOKEN in environment variables or a secrets manager — never commit them.

Prefer least-privilege GitHub tokens (public read is enough for open issues).

Rotate keys if they appear in logs or shared screenshots.

Issue text is untrusted. Prompts include third-party issue bodies and comments. Treat model output as data, not instructions for privileged actions.

Scores are advisory. Do not gate merges, bans, or billing solely on Gemini scores.

SVG badges are public. Anyone who knows an id can fetch the timer image; do not encode secrets in badge URLs.

Models can misread sarcasm, partial fixes, or “won’t fix” rationales.

Comment samples may be incomplete if fetch limits truncate threads.

Categories should be shown as AI judgment with human override available.

Timer responses disable caching so embeds refresh; this increases request volume — rate-limit or CDN carefully in production.

Anonymous GitHub API use is rate-limited; set GITHUB_TOKEN for sustained registration traffic.

Prefer authenticated admin surfaces before allowing bulk registration that could spam maintainers.