WhyLine reads local git history and, optionally, calls the GitHub API through the gh CLI. Two areas deserve care:

• --synthesize-command executes a user-supplied shell command. WhyLine runs exactly the string the user passes on their own machine, the same trust model as git config core.editor or a shell alias. Never paste a synthesize command from an untrusted source.
• Commit messages, PR bodies, and diffs are untrusted input. WhyLine treats them as plain text and never executes or interprets them.

Open a GitHub security advisory on this repository, or email andre.x.ruizloera@gmail.com. Please include a reproduction. You should hear back within a week.