PatchLeague is currently pre-1.0. Security fixes are applied to the latest released version.

Please use GitHub's private vulnerability reporting for this repository. Do not open a public issue containing credentials, private source code, or a working exploit.

Include the affected command, operating system, PatchLeague version, impact, and minimal reproduction steps. Remove provider tokens and repository secrets from all logs.

PatchLeague executes configured coding-agent CLIs and user-selected verification commands. These processes can execute code with the permissions of the current user.

Git worktrees isolate patches from the main checkout, but they are not security sandboxes. Until an OS-level sandbox backend is available:

• run only trusted repositories and agent configurations;
• review .patchleague/config.json before a competition;
• avoid running untrusted pull-request code;
• inspect a winning patch before applying it;
• keep provider credentials scoped as narrowly as their CLIs allow.

PatchLeague does not upload repository contents and does not store provider credentials.