{"repo":"NousResearch/hermes-agent","public_id":"92457","display_label":"Profile export security and safe file writing","summary":"These items address security concerns around profile archive exports, including writing to temp files before renaming to avoid partial writes, ensuring exports do not land in sensitive build contexts, and responding to an exposed credential related to a committed profile archive.","subsystem":null,"counts":{"members":3,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":2,"attempt_prs":0},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":100101,"merged_at":"2026-09-01T08:00:24+00:00"},"resolution":{"state":"unresolved","by":null},"freshness":{"state":"verified","last_verified_at":"2026-09-01T08:00:24+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.6666666666666666},"fix_edges":[{"issue_number":92457,"pr_number":97835,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false,"pr_merged_at":"2026-08-31T18:19:07+00:00"},{"issue_number":92457,"pr_number":100101,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false,"pr_merged_at":"2026-09-01T08:00:24+00:00"}],"members":[{"kind":"issue","number":92457,"title":"security: rotate exposed webhook credential and republish affected images after committed profile archive","url":null,"state":"closed"},{"kind":"pr","number":97835,"title":"fix(profiles): make_targz writes to a temp file and renames, not the destination directly","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["hermes_cli/archive_safe.py","tests/hermes_cli/test_archive_safe.py"]},{"kind":"pr","number":100101,"title":"fix(security): profile exports never land in source or image contexts (resurrect #92689)","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":[".dockerignore",".github/workflows/ci.yaml",".github/workflows/docker.yml",".github/workflows/profile-artifact-check.yml",".gitignore","hermes_cli/cli_commands_mixin.py","hermes_cli/main.py","hermes_cli/profiles.py","hermes_cli/subcommands/profile.py","hermes_cli/web_routers/profiles.py","scripts/ci/check_profile_archive_boundary.py","tests/hermes_cli/test_profile_export_default_path.py","tests/scripts/test_check_profile_archive_boundary.py","website/docs/user-guide/profile-distributions.md"]}],"trust":{"default_tier":"verified","includes_suggested":false}}