[CRITICAL] ReportBot retry: untrusted hooks bypass read-only mode #3300

Activity

1. 1716775457damn commented on Sep 14, 2026

   

   1716775457damn

   on Sep 14, 2026

   More actions

   This looks like a duplicate delivery of the same report — the body is just a retry test with no additional detail, and the actual vulnerability is tracked in #3301 ([CRITICAL][SECURITY] Untrusted project hooks bypass read-only mode). Suggest closing this one to avoid duplicate tracking; all related discussion and the fix proposal are consolidated in #3301.
2. 1716775457damn commented on Sep 15, 2026

   

   1716775457damn

   on Sep 15, 2026

   More actions

   同意上面的判断：本条正文仅为 retry 测试、无额外信息，属于 #3301 的重复投递。建议直接关闭，避免双轨跟踪；修复 PR 会在 #3301 内同步进展。