Report a vulnerability privately, through Report a vulnerability using this repository's Security tab, never in a public issue. Pullboard runs on your machine, and your agents interact with it; it connects to the network only when you turn the relay on. Relay can't read your boards: they're sealed with keys that stay on your devices, and it never holds code or writes to a repository. Pullboard runs the commands a repo configures (the gate, checks, etc).