5.4 GitHubIssueSubmitter Plugin
GitHubIssueSubmitter provides the in-application feedback modal and creates an issue in the configured GitHub repository. The endpoint is intentionally available without member authentication, so rate limiting and strict data handling are part of the feature boundary.
Components
IssueSubmitterCellconditionally renders the modal when the plugin setting is active.github-submitter-controller.jssubmits the form and renders the asynchronous result.IssuesController::submit()sanitizes title/body, appliesRequestRateLimiter::BUCKET_GITHUB_ISSUE, calls GitHub’s Issues API with short timeouts, and parses the response into JSON for the client.IssuesControllerPolicydocuments the public submission policy even though the action uses the explicit unauthenticated/skip-authorization path.
Configuration
Settings initialized by the plugin include:
KMP.GitHub.OwnerKMP.GitHub.Project- the GitHub token under the
KMP.GitHubconfiguration value Plugin.GitHubIssueSubmitter.ActivePlugin.GitHubIssueSubmitter.PopupMessage
Treat the token as a secret: never display it, log it, include it in client-side data, or copy it into documentation. Use the least GitHub scope needed to create issues in the configured repository.
Security and privacy
The form is anonymous and explicitly warns users not to submit personal information or support requests. Keep that warning visible. Do not append session, tenant, member, request-header, or environment details to the issue body unless a future design explicitly obtains consent and redacts sensitive values.
Preserve rate limiting, outbound connection/read timeouts, JSON shape checks, safe user-facing errors, and server-side logging. Map upstream failures to an application-owned message; do not return GitHub error content that may reveal configuration.
Known implementation gap (2026-08-28): when GitHub returns a JSON message, IssuesController::submit() currently forwards that value to the anonymous client and writes it to the server log. Treat response scrubbing as outstanding security work; callers must not assume upstream messages are safe.
Multi-tenant behavior
The request is still resolved by host before plugin settings are read. Repository configuration can therefore be tenant-specific. Cache/config lookups and rate-limit keys must not allow one host to influence another tenant unexpectedly.
Accessibility and verification
The Bootstrap modal needs a programmatic name, focus containment/restoration, labeled fields, an announced submitting/success/error state, and keyboard-operable dismissal. Test disabled rendering, rate limiting, input sanitization, GitHub success/malformed/error responses, timeouts, secret non-disclosure, tenant-specific settings, and Stimulus disconnect/reconnect behavior.