Security at githug
githug hands coding agents GitHub access, so here is exactly what that access is, what we keep, and how to cut it off. Last updated 9 October 2026.
What an agent can do
- One repo, one hour. Every token githug mints comes from a GitHub App installation, is limited to a single repository, and expires after an hour.
- Narrow permissions. By default: read and write repository contents, pull requests and issues, and read metadata. Never administration, workflows, secrets or members. You can narrow an agent further; a sub-agent can only ever have a subset of its parent's repos and permissions.
- Your rules still apply. Tokens can push branches. Your branch protection and rulesets on GitHub still decide what reaches main; githug doesn't bypass them.
- Only where you installed it. An agent can only be created on repositories that the githug App, or the agent's own App, is installed on and that you can see on GitHub. githug checks this against GitHub with your own sign-in, not against anything the agent sends.
What we keep, and how
| How it's stored | |
|---|---|
Agent keys (ghg_…) and CLI keys (hug_…) |
256-bit random; we keep only a SHA-256 hash. Shown to you once |
| Web sessions | Random cookie (HttpOnly, Secure, SameSite=Lax); we keep only its hash; 30 days |
| Your GitHub sign-in (OAuth tokens) | Encrypted with AES-256-GCM; the key lives in Cloudflare Workers secrets, not the database |
| Private keys of agents' own GitHub Apps | Encrypted the same way |
| Tokens agents push with | Not stored. Logged as a row (agent, repo, time, run, a hashed IP), never the token |
| Read-only tokens githug uses itself | Cached up to 50 minutes, read-only (contents, pull requests, metadata), to run the verify page and track PR outcomes |
githug never clones your repository or reads your code. The verify page, the verify Action and PR tracking read commit and pull request metadata only: hashes, messages, authors, dates and states.
Cutting access
- An agent: disable it or rotate its key in your dashboard. Disabling an agent disables every sub-agent under it. The old key stops working immediately.
- A machine: revoke its CLI login in your dashboard.
- Everything: uninstall the githug App (and any agent's own App) in your GitHub settings under Applications. GitHub stops issuing tokens at once; tokens already issued expire within the hour.
Open source
The service githug.ai runs is open source at github.com/githug-ai/githug (AGPL-3.0), so you can read exactly how keys, tokens and checks work, or run it yourself. The CLI, hug, is at github.com/githug-ai/hug (Apache-2.0); every release binary on githug.ai has a matching public tag and SHA-256 sums, which the installer checks. The verify Action is at github.com/githug-ai/verify. The hosted service runs on Cloudflare Workers.
Reporting a vulnerability
Use Report a vulnerability on the Security tab of githug-ai/githug (or of githug-ai/hug for the CLI), which stays private, or email hello@githug.ai. Please give us a chance to fix it before you publish. We don't run a paid bounty.