Security
How SkillIssues handles your account, your code and the contribution process.
Your account
You sign in with GitHub through an app that asks for no permissions. We read your numeric GitHub id, username, the name on your GitHub profile and your avatar, then discard the token. Your account is tied to that id, never to your username, which GitHub lets someone else take.
A session lasts until you sign out, it expires, or you sign out everywhere. It lives in a secure, HTTP-only cookie.
Your code
Anything that writes to GitHub (forking, pushing, opening pull requests) happens in the desktop app, with a token that stays on your computer. It never reaches our servers.
Our servers
Every release is built by our public CI, signed, and verified on the server before it runs. Secrets are stored encrypted, and backups are encrypted with a key that isn’t on the server.
Themes
The app can be restyled with themes, including ones other people share. A theme’s stylesheet is checked against a strict allowlist and can’t load anything from elsewhere, and the browser blocks it from trying.
Reporting a vulnerability
Please don’t open a public issue. Use GitHub’s private vulnerability reporting, which only the maintainers can see, and tell us what’s affected, how to reproduce it, and whether you’ve seen it exploited.