v0.1.2

Gate runs untrusted pull request code in a hardened sandbox, captures the preview deploy, and publishes a design review as a sticky comment and a Check Run. It does not produce the critique itself; you point it at a critique service.

Fixed: a pull request could forge Gate's own verdict

The sticky comment is Markdown, and its structure is what tells a reader which words are Gate's: the ## Apature Gate: design review heading and the bold grade line under it. Engine-supplied fields reached that comment unsanitized, so a crafted suggestion could close the <details> block it sat in and open a second heading with **✅ Ship** under it. A reviewer scrolling the comment saw Gate apparently approving the pull request.

This never executed anything: GitHub strips raw HTML. It was forgery, and it did not need a compromised engine, because a model's prose derives partly from the untrusted page text of the pull request under review.

Every field originating from the engine or the model is now escaped so it cannot open a block construct, close one, forge a grade line, or break out of a table cell. Also closed in this release:

• Bare www. hosts are defanged. GitHub autolinks them with no scheme present, so a rule anchored on https?:// could never match one. SECURITY.md claimed this was covered before it was true.
• Evidence URLs carrying credentials in the authority are refused. https://github.com@attacker.example/x.png reads as one host and resolves to another, under Gate's own "Evidence" anchor text.
• A pipe in an evidence URL no longer ends the table cell and silently drops the link.
• Bidirectional controls such as U+202E are stripped rather than escaped. Escaping does nothing against a character whose whole effect is on rendering.

Also in this release

The Check Run now states the engine's grounding drop count. Zero findings and three findings that could not be grounded both arrive as an empty list under a ship grade, and only the engine knew which happened.

Upgrading

@v1 now points here. If you pin a version, move to v0.1.2; v0.1.1 renders unsanitized engine output.

Honest limitations

Gate does not critique anything itself. Without a critique service configured it publishes a neutral Check Run saying so, never a pass. A triage pass in the reference engine can report full coverage over routes it did not deeply review; that is tracked upstream and is not fixed here.