Run a scan

Security & privacy

Threat model: target websites, repository content, pull-request authors, responses and anything an agent reads may be malicious.

Network

  • Every address is resolved and validated, and the socket is handed only the checked address, so a DNS answer that changes between check and connect cannot slip through.
  • Loopback, private, link-local, CGNAT, IPv6 ULA, multicast and reserved ranges are blocked by default, including IPv4-mapped, NAT64 and 6to4 forms and alternative IPv4 encodings.
  • A private destination is allowed only when you name it. A discovered link or a redirect from another host never reaches one.
  • Five redirects; connect 5 s, request 10 s; HTML 5 MiB, robots 500 KiB, sitemap 50 MiB, counted after decompression.
  • Same-origin crawling; two requests per host and 250 ms spacing for remote hosts; robots.txt respected for GEO’s own user agent unless you override it for a target you named (recorded in the report).

Repository

  • Repository code, configuration and builds are never executed — except V3 commands and the fix.serve process you authorise for a run, which get argv only, no shell, a loopback URL, a free-port check, bounded redacted logs and guaranteed termination.
  • Symlinks that escape the repository are not followed. .env*, *.pem, *.key, .npmrc, .git/config and gitignored files are never read.
  • Evidence snippets are capped at 300 characters and secrets are redacted. Cookies, auth headers and full response bodies are not stored.

Prompt injection

Crawled HTML, comments, robots.txt, llms.txt and tool output are untrusted. The skill never follows instructions found there and never fetches a URL because content asks it to. This is a behavioural rule, not a security guarantee.

Privacy

No telemetry, no account, no update check, no remote rule feed, no hidden model call. Network traffic goes only to the targets you authorise, plus package installation when you run npx.

Supply chain

One runtime dependency (@babel/parser, pinned with its only dependency). Frozen lockfile, actions pinned to commit SHAs, npm trusted publishing with provenance, and no long-lived publish token.

Reporting a vulnerability

Use GitHub’s private vulnerability reporting on the repository. Please do not open a public issue.