Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.
Report them privately through GitHub instead: Security → Report a vulnerability. Only you and the maintainers can see the report. The maintainers may invite you to work on the fix with them in a temporary private fork.
Please include:
- the affected component (for example: desktop app, CLI,
orca serve, SSH relay, mobile app or pairing, runtime RPC, browser pane, agent hooks, Orca Cloud relay) - the Orca version or commit, and the operating system
- steps to reproduce, or a proof of concept
- the impact: what an attacker could do, and what access they need first (local user, same network, a malicious repository, a malicious web page, a compromised SSH host)
Orca runs agents, terminals and Git against local repositories, remote SSH hosts and paired devices. Examples of what is in scope:
- secrets or credentials (agent-hook tokens, pairing keys, Git or provider credentials) reaching a process, host or page that should not have them
- IPC or RPC trust boundaries that a renderer, web page, deep link or remote host can cross
- command or path injection through repository content, branch names, file names or deep links
- unauthenticated access to a local or network-reachable Orca service
Out of scope: vulnerabilities in third-party agent CLIs, the user's own Git or SSH binaries, or upstream dependencies, unless Orca's use of them makes the problem worse. Please report those to their maintainers.
Fixes land on main and ship in the next release. Please check that the issue reproduces on the latest release or on main before reporting.
Please give the maintainers a reasonable chance to release a fix before you share details publicly. Once a fix ships, the advisory can be published with credit to the reporter if they want it.