Skip to content
⌘K
Explore
Download
Docs
Sign in
Sign up
flagon-io
/
g1t
public
Star
0
Overview
Code
Issues
Pull requests
Workflows
Deployments
Insights
Files
Commits
Branches
Tags
Releases
Compare
4ef467f8856abf8db69ce41b3de7f017a7483b0e
g1t
/
…
/
services
/
events
/
migrations
syntaqx
The advisories a repository publishes live in security_advisories: the security database already had an advisories table, its cache of OSV advisories, so the migration for repository advisories stopped at its first statement on deploy.
4ef467f
1d ago
History
0001_init.sql
0002_audit.sql
0003_g1t_name.sql
0004_audit_retention.sql
0005_inbox.sql
0006_inbox_threads.sql
0007_fanout_sent.sql
0008_events_by_type.sql
0009_security_digest.sql
0001_init.sql
Events service in Rust, with RFC 3339 times and accurate push events
10d ago
0002_audit.sql
Agents get guardrails, run credentials, an audit log, a context hub, repository instructions and mentions; security upkeep; snake_case API
7d ago
0003_g1t_name.sql
g1t is one name: its agent's work, commits and comments show as @g1t, and nobody can claim g1t or g1t-agent
6d ago
0004_audit_retention.sql
Audit logs are kept by plan: a week on free, 90 days on the plan, and what staff set for an account in sudo
6d ago
0005_inbox.sql
Inbox: the events service tells people what needs them as events arrive
5d ago
0006_inbox_threads.sql
Inbox: threads, reasons, subscriptions and watching
5d ago
0007_fanout_sent.sql
Merge branch 'worktree-agent-ad8a36dfcd4176015' into spend-guardrails
4d ago
0008_events_by_type.sql
Merge branch 'worktree-agent-ab9543c492a7ed481' into spend-guardrails
4d ago
0009_security_digest.sql
Security tells people the way they can live with. Each scan publishes one summary event per alert type (secret_scanning_alert.summary, code_scanning_alert.summary, vulnerability_alert.summary: what it opened, by severity, what it fixed, what is open now, the worst new alert and the newest one's title, with the owners and security managers to tell) beside the per-alert events webhooks keep, so the inbox holds one thread per repository and alert type that the next scan brings up to date instead of one item per finding, and the ids are capped at 200 while the counts are not. Critical and high alerts and a refused push reach the inbox at once (and toast like a mention, as the new security notification kind); medium and low wait for each person's security digest, one inbox item and email per workspace, daily or weekly as they choose in their notification settings, at once, or never; a scan that opened nothing refreshes the thread quietly ("2 of 3 fixed") and marks it done when nothing is left open; and security alerts are emailed by default. A repository can turn alerts for secrets found in its history off while push protection stays on. Reporting arrives: security advisories (G1TSA ids, drafts published and withdrawn by Admins and security managers, visible to anyone who can see the repository once published) and private vulnerability reporting (a repository setting; anyone who can see it may report, signed out with an email on a public one, five a day each, and the owners and security managers are told at once), each with its RPC methods, REST routes under /repos/{owner}/{name}/security/advisories and /security/reports, MCP actions, scopes and reference examples.
1d ago
