GitHub Copilot App

Synopsis

GitHub Copilot App is an agent-native desktop experience for managing software work from idea to pull request. The app is built for parallel agent-driven development. Each local session runs in its own isolated git worktree, and cloud sessions let agents keep working in isolated GitHub-hosted environments that you can pick up from anywhere.

Even if the issue you identified is out-of-scope and ineligible for our bounty program, we encourage you to open an issue upstream. Please see our severity guidelines for more information about how severities are calculated.

Focus areas

• Remote code execution via protocol handlers such as ghapp://
• Code execution without user interaction such as when cloning or fetching malicious repositories
• Code execution that requires minimal, expected user interaction, such as performing actions on a repository that a user would not expect to lead to code execution

Out of scope

• Code execution requiring social-engineering or unlikely user interaction is typically not eligible for rewards.
• Vulnerabilities which do not trigger code-execution are out-of-scope and ineligible for reward.