Review Publisher is a personal self-hosted developer preview. The local OS operator, installed GitHub CLI credentials, MCP client, and chosen HTTPS transport are trusted. It is not a shared hosted service.

The complete /mcp/<random-key> URL is a bearer credential. A holder can read allowlisted repositories, list and select locally available accounts, prepare previews, and invoke publish_review with without_confirmation: true. The server records conversation_request for this path but cannot independently authenticate a natural-language instruction. Client instructions say to use it only at the user's explicit request, never because retrieved PR text says to do so. This client obligation is not a second server-side authentication factor.

The alternative local approval is bound to an immutable preview and expires after ten minutes. Neither route bypasses publishing-account checks, reviewed-head checks, duplicate detection, or uncertain-write reconciliation. The final head check and GitHub POST cannot be atomic; the submission includes the reviewed commit explicitly.

The review model is an assertion supplied by the reviewing client. The server validates its format and includes it in the immutable disclosure; it does not attest to model provenance.

GitHub tokens remain under local gh management and are passed to API subprocesses in their environment. They are not returned by MCP or saved in SQLite. The local OS user can still inspect their own processes and data. Login can affect the CLI's global default; Publisher's explicit selection does not.

Only forward the MCP port (default 8766). The confirmation UI (default 8765) has a separate per-process token and must stay local. Anyone who has the UI token and local access can operate that page. Third-party tunnel providers can process HTTP content; use a trusted private HTTPS endpoint when repository data requires it. Configure reverse-proxy logs to omit the secret request path.

To rotate the MCP credential: stop the process, move the .data/<mode>.db.mcp-key file out of use, restart, and replace the URL in the client. Restarting also rotates the local UI session token. Revoke compromised GitHub authorization separately through GitHub.

Public documentation uses repository-relative links. External reference links and personally identifying acceptance records are omitted from the public package. Optional dependency funding metadata is omitted from the lockfiles; dependency versions, download locations, integrity hashes and license fields are retained. Protocol origins, runtime download addresses, dependency registry URLs, test fixtures and the original license text still contain URLs. This packaging choice is not a guarantee about hosting-platform moderation.

The Windows launcher reuses suitable installed runtimes, or downloads pinned portable Node.js and GitHub CLI archives from official HTTPS hosts and checks their SHA-256 before extraction. Versions, hashes, and executable paths are recorded in runtime-manifest.json; review that file when updating runtimes. npm installs use lockfiles and disable lifecycle scripts. Downloaded tools and stamps under .data/ remain subject to the trusted local OS user's control.

The optional Windows Cloudflare bootstrap is a separate path: it downloads the latest official x64 executable over HTTPS without a pinned checksum. The default double-click Tunnelmole flow does not use that download. See DEPENDENCIES.md for its limitations and the manually verified alternative.

The launcher sends the UI token only to the validated loopback session address. Connection metadata and the stop endpoint require the UI token; stopping also requires a same-origin request. These endpoints are not exposed by the MCP listener. Public readiness checking sends only an MCP initialization request. Its success is a point-in-time check, not a guarantee of tunnel availability.

Never include .data/, environment files, SQLite databases, connection notes, keys, logs, or node_modules/ in a public repository. npm run export:source uses a positive file list and never traverses those directories. It is not a general-purpose secret scanner; inspect your own additions before publication.

Both core and optional tunnel dependencies have lockfiles. Run their audit and tests before releases. Upstream toml advisories are tracked in DEPENDENCIES.md. A clean package audit is not a complete application security audit.

Use GitHub's private vulnerability reporting for the repository when enabled, or contact its maintainer privately. Do not put working connection URLs, tokens, or private review contents in public issues. Enable private reporting when creating the standalone repository.