Security Policy

PR-Agent is an open-source tool to help efficiently review and handle pull requests. Qodo Merge is a paid version of PR-Agent, designed for companies and teams that require additional features and capabilities.

This document describes the security policy of PR-Agent. For Qodo Merge's security policy, see here.

PR-Agent Self-Hosted Solutions

When using PR-Agent with your OpenAI (or other LLM provider) API key, the security relationship is directly between you and the provider. We do not send your code to Qodo servers.

Types of self-hosted solutions:

• Locally
• GitHub integration
• GitLab integration
• BitBucket integration
• Azure DevOps integration

PR-Agent Supported Versions

This section outlines which versions of PR-Agent are currently supported with security updates.

Docker Deployment Options

Latest Version

For the most recent updates, use our latest Docker image which is automatically built nightly:

uses: the-pr-agent/pr-agent@main

Specific Release Version

For a fixed version, you can pin your action to a specific release version. Browse available releases at: PR-Agent Releases

For example, to github action:

steps:
  - name: PR Agent action step
    id: pragent
    uses: docker://pragent/pr-agent:0.34.2-github_action

Enhanced Security with Docker Digest

For maximum security, you can specify the Docker image using its digest:

steps:
  - name: PR Agent action step
    id: pragent
    uses: docker://pragent/pr-agent@sha256:a0b36966ca3a197ca739fa1e65c16703076fc1c744cd423ca203b8c21707d71c

Official Docker Hub release images also publish GitHub Artifact Attestations, so you can verify a pinned digest before using it:

gh attestation verify \
  "oci://index.docker.io/pragent/pr-agent@sha256:<digest>" \
  --repo The-PR-Agent/pr-agent

Reporting a Vulnerability

We take the security of PR-Agent seriously. If you discover a security vulnerability, please report it immediately to:

Email: [email protected]

Please include a description of the vulnerability, steps to reproduce, and the affected PR-Agent version.