Skip to content

⌘K

Explore Download Docs

flagon-io/g1t

public

Overview Code Issues Pull requests Workflows Deployments Insights

Files Commits Branches Tags Releases Compare

g1t/…/services/security/src

ClaudeagentMerge branch 'claude/zen-ptolemy-01vsx1': never leave a page stuck on its loading bar62f5012yesterdayHistory

..
advisories.rs
code_scanning.rs
config.rs
deps.rs
fixes.rs
history.rs
lib.rs
manifests.rs
overview.rs
patterns.rs
planning.rs
pull_text.rs
ranges.rs
registries.rs
resolved.rs
schedule.rs
secret_alerts.rs
security_updates.rs
store.rs
suite.rs
suite_store.rs
summaries.rs
supply_chain.rs
timezones.rs
update_store.rs
updates.rs
version_updates.rs
yaml.rs

Where your team and its coding agents ship code.

Product

Explore
Pricing
Download
Chat
Bring your own agent
Integrations

Developers

Documentation
API reference
MCP tools
llms.txt

Company

Flagon, Inc.
Support
Security
Status

Open source

Source on g1t
MIT license
Run g1t yourself

g1t is designed, built, and backed by Flagon, Inc., a small, independent software company founded by Chase Pierce.

Checking statusStatus
Support
Policies
Privacy
Security

·

Sign in
© 2026 Flagon, Inc. All rights reserved.

..
advisories.rsThe advisories a repository publishes live in security_advisories: the security database already had an advisories table, its cache of OSV advisories, so the migration for repository advisories stopped at its first statement on deploy.yesterday
code_scanning.rsSecurity tells people the way they can live with. Each scan publishes one summary event per alert type (secret_scanning_alert.summary, code_scanning_alert.summary, vulnerability_alert.summary: what it opened, by severity, what it fixed, what is open now, the worst new alert and the newest one's title, with the owners and security managers to tell) beside the per-alert events webhooks keep, so the inbox holds one thread per repository and alert type that the next scan brings up to date instead of one item per finding, and the ids are capped at 200 while the counts are not. Critical and high alerts and a refused push reach the inbox at once (and toast like a mention, as the new security notification kind); medium and low wait for each person's security digest, one inbox item and email per workspace, daily or weekly as they choose in their notification settings, at once, or never; a scan that opened nothing refreshes the thread quietly ("2 of 3 fixed") and marks it done when nothing is left open; and security alerts are emailed by default. A repository can turn alerts for secrets found in its history off while push protection stays on. Reporting arrives: security advisories (G1TSA ids, drafts published and withdrawn by Admins and security managers, visible to anyone who can see the repository once published) and private vulnerability reporting (a repository setting; anyone who can see it may report, signed out with an email on a public one, five a day each, and the owners and security managers are told at once), each with its RPC methods, REST routes under /repos/{owner}/{name}/security/advisories and /security/reports, MCP actions, scopes and reference examples.yesterday
config.rsTeams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar5d ago
deps.rsSecurity tells people the way they can live with. Each scan publishes one summary event per alert type (secret_scanning_alert.summary, code_scanning_alert.summary, vulnerability_alert.summary: what it opened, by severity, what it fixed, what is open now, the worst new alert and the newest one's title, with the owners and security managers to tell) beside the per-alert events webhooks keep, so the inbox holds one thread per repository and alert type that the next scan brings up to date instead of one item per finding, and the ids are capped at 200 while the counts are not. Critical and high alerts and a refused push reach the inbox at once (and toast like a mention, as the new security notification kind); medium and low wait for each person's security digest, one inbox item and email per workspace, daily or weekly as they choose in their notification settings, at once, or never; a scan that opened nothing refreshes the thread quietly ("2 of 3 fixed") and marks it done when nothing is left open; and security alerts are emailed by default. A repository can turn alerts for secrets found in its history off while push protection stays on. Reporting arrives: security advisories (G1TSA ids, drafts published and withdrawn by Admins and security managers, visible to anyone who can see the repository once published) and private vulnerability reporting (a repository setting; anyone who can see it may report, signed out with an email on a public one, five a day each, and the owners and security managers are told at once), each with its RPC methods, REST routes under /repos/{owner}/{name}/security/advisories and /security/reports, MCP actions, scopes and reference examples.yesterday
fixes.rsTeams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar5d ago
history.rsTeams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar5d ago
lib.rsA repository's Security overview is one row per feature in three groups, each with a status word (Enabled, Disabled, Needs setup, Coming), a line on what it does and the one thing to do about it: the security policy (View policy, or Set up a security policy, which commits a starting SECURITY.md on a branch and opens it as a pull request), dependency alerts, security updates (the switch, kept on Vulnerabilities and now in Settings too), code scanning (Enabled once an analysis was uploaded), secret scanning (push protection always on) and code quality as Coming; and under Reporting, advisories and the private vulnerability reporting switch. Anyone who can see a public repository but has no role on it sees the public face at the same address: the policy, the published advisories and, when it is on, Report a vulnerability. Advisories get their pages (the list with its state filter, one advisory with Publish, Withdraw and Edit, a form for a new draft or changes) and reports theirs (new ones first, each accepted into a draft advisory or declined), with a Reports page beside Advisories and an Advisories tab; the public report form takes an email when signed out and counts against the front door's heavy limit. Security settings gain Alerts for secrets in the history and Private vulnerability reporting. Settings → Notifications gains a Security section: critical and high alerts at once (always, for the workspaces one owns or manages security for) and the rest in a daily or weekly digest, at once, or not at all, with security alerts now among the email reasons. The notifications guide says how security alerts arrive and what the digest is, the security guide the overview's rows and the public face, secret protection the history alerts switch, webhooks the summary and advisory events, and a new guide covers advisories and private reporting; the report_settings method lets the public page know whether a repository takes reports.yesterday
manifests.rsTeams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar5d ago
overview.rsMerge main (membership, two-factor, GitHub repo roles) into tokens5d ago
patterns.rsMerge main (membership, two-factor, GitHub repo roles) into tokens5d ago
planning.rsTeams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar5d ago
pull_text.rsTeams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar5d ago
ranges.rsTeams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar5d ago
registries.rsTeams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar5d ago
resolved.rsMerge update PRs close themselves: g1t closes its security and version updates once they are no longer needed, and deletes their branches4d ago
schedule.rsTeams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar5d ago
secret_alerts.rsSecurity tells people the way they can live with. Each scan publishes one summary event per alert type (secret_scanning_alert.summary, code_scanning_alert.summary, vulnerability_alert.summary: what it opened, by severity, what it fixed, what is open now, the worst new alert and the newest one's title, with the owners and security managers to tell) beside the per-alert events webhooks keep, so the inbox holds one thread per repository and alert type that the next scan brings up to date instead of one item per finding, and the ids are capped at 200 while the counts are not. Critical and high alerts and a refused push reach the inbox at once (and toast like a mention, as the new security notification kind); medium and low wait for each person's security digest, one inbox item and email per workspace, daily or weekly as they choose in their notification settings, at once, or never; a scan that opened nothing refreshes the thread quietly ("2 of 3 fixed") and marks it done when nothing is left open; and security alerts are emailed by default. A repository can turn alerts for secrets found in its history off while push protection stays on. Reporting arrives: security advisories (G1TSA ids, drafts published and withdrawn by Admins and security managers, visible to anyone who can see the repository once published) and private vulnerability reporting (a repository setting; anyone who can see it may report, signed out with an email on a public one, five a day each, and the owners and security managers are told at once), each with its RPC methods, REST routes under /repos/{owner}/{name}/security/advisories and /security/reports, MCP actions, scopes and reference examples.yesterday
security_updates.rsA desktop release goes out with what can be built. Linux is built on g1t's machines in every release; Windows and macOS each wait on a repository variable: a machine registered for them, or for Windows a cross build on Linux once aka.ms and download.visualstudio.microsoft.com are workflow-only domains, which is where the first release stopped. A platform with no machine is skipped and the download page says it is coming, with a word for the visitor whose platform this release lacks. The guide and CONTRIBUTING say so.2d ago
store.rsMerge update PRs close themselves: g1t closes its security and version updates once they are no longer needed, and deletes their branches4d ago
suite.rsSecurity tells people the way they can live with. Each scan publishes one summary event per alert type (secret_scanning_alert.summary, code_scanning_alert.summary, vulnerability_alert.summary: what it opened, by severity, what it fixed, what is open now, the worst new alert and the newest one's title, with the owners and security managers to tell) beside the per-alert events webhooks keep, so the inbox holds one thread per repository and alert type that the next scan brings up to date instead of one item per finding, and the ids are capped at 200 while the counts are not. Critical and high alerts and a refused push reach the inbox at once (and toast like a mention, as the new security notification kind); medium and low wait for each person's security digest, one inbox item and email per workspace, daily or weekly as they choose in their notification settings, at once, or never; a scan that opened nothing refreshes the thread quietly ("2 of 3 fixed") and marks it done when nothing is left open; and security alerts are emailed by default. A repository can turn alerts for secrets found in its history off while push protection stays on. Reporting arrives: security advisories (G1TSA ids, drafts published and withdrawn by Admins and security managers, visible to anyone who can see the repository once published) and private vulnerability reporting (a repository setting; anyone who can see it may report, signed out with an email on a public one, five a day each, and the owners and security managers are told at once), each with its RPC methods, REST routes under /repos/{owner}/{name}/security/advisories and /security/reports, MCP actions, scopes and reference examples.yesterday
suite_store.rsTeams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar5d ago
summaries.rsSecurity tells people the way they can live with. Each scan publishes one summary event per alert type (secret_scanning_alert.summary, code_scanning_alert.summary, vulnerability_alert.summary: what it opened, by severity, what it fixed, what is open now, the worst new alert and the newest one's title, with the owners and security managers to tell) beside the per-alert events webhooks keep, so the inbox holds one thread per repository and alert type that the next scan brings up to date instead of one item per finding, and the ids are capped at 200 while the counts are not. Critical and high alerts and a refused push reach the inbox at once (and toast like a mention, as the new security notification kind); medium and low wait for each person's security digest, one inbox item and email per workspace, daily or weekly as they choose in their notification settings, at once, or never; a scan that opened nothing refreshes the thread quietly ("2 of 3 fixed") and marks it done when nothing is left open; and security alerts are emailed by default. A repository can turn alerts for secrets found in its history off while push protection stays on. Reporting arrives: security advisories (G1TSA ids, drafts published and withdrawn by Admins and security managers, visible to anyone who can see the repository once published) and private vulnerability reporting (a repository setting; anyone who can see it may report, signed out with an email on a public one, five a day each, and the owners and security managers are told at once), each with its RPC methods, REST routes under /repos/{owner}/{name}/security/advisories and /security/reports, MCP actions, scopes and reference examples.yesterday
supply_chain.rsTeams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar5d ago
timezones.rsTeams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar5d ago
update_store.rsTeams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar5d ago
updates.rsTeams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar5d ago
version_updates.rsA desktop release goes out with what can be built. Linux is built on g1t's machines in every release; Windows and macOS each wait on a repository variable: a machine registered for them, or for Windows a cross build on Linux once aka.ms and download.visualstudio.microsoft.com are workflow-only domains, which is where the first release stopped. A platform with no machine is skipped and the download page says it is coming, with a word for the visitor whose platform this release lacks. The guide and CONTRIBUTING say so.2d ago
yaml.rsTeams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar5d ago