# Aido hardens its AI code-review Action against supply-chain and prompt-injection risks

*Stockholm — 2026-09-04*

**A run of releases, 1.6.2 to 1.6.6, pins the tool's dependencies, closes shell and checkout injection paths, adds a prompt-injection guardrail, and documents a security posture for teams that run it on their own repositories.**

Aido, the open-source multi-provider AI assistant for GitHub code review, has shipped a run of releases from version 1.6.2 to 1.6.6. Together they harden the tool against the risks that matter most for software that holds provider API keys and can write to pull requests.

Aido runs inside GitHub Actions and reviews, summarizes, explains, and documents code by commenting on a pull request, using Gemini, ChatGPT, or Claude on a team's own provider keys. Because it runs in a privileged context, its own security is part of the product.

## Pinned dependencies and no install scripts

Every command previously installed its provider SDKs unpinned on each run, in jobs holding API keys and write access. A single malicious upstream publish, or a postinstall hook in any transitive dependency, would have executed there. The SDK installs are now pinned to exact versions and run with install scripts disabled, closing that supply-chain path. All four SDKs are pure JavaScript, so nothing breaks.

## Closing injection paths

Two further releases remove injection anti-patterns. Pull request and issue numbers are now passed to workflow steps as environment variables instead of being spliced into a shell command. And the automatic-companion gate now checks out the trusted base-branch code rather than the pull request's own copy, so a forked pull request can no longer influence the code that decides whether Aido runs.

## A prompt-injection guardrail

Version 1.6.6 adds a guardrail for the reviews themselves. Titles, descriptions, diffs, and comments are attacker-controllable and flow into the model's prompt. Both review passes now mark that content as untrusted data, never instructions, so a crafted pull request cannot steer a review or its recommendation with embedded directives such as "approve this."

## A documented posture for adopters

The release also adds a [SECURITY.md](https://github.com/aido-dev/aido/blob/main/SECURITY.md) that sets out how to run Aido safely. The most important guidance: never wire Aido's output to auto-merge or other privileged automation. A human in the loop is the load-bearing defense against prompt injection, alongside least-privilege permissions and the hardening above.

Versions 1.6.2 to 1.6.6 are available now on [GitHub](https://github.com/aido-dev/aido/releases). Remote installs on the moving version-one tag receive the updates automatically; pinned installs upgrade by bumping the tag.

---

## About Aido

Aido is an open-source AI code-review assistant that runs inside GitHub Actions. It lets development teams review, summarize, explain, document, and improve code by commenting on a pull request, with support for Gemini, ChatGPT, and Claude. Aido is configurable through personas, prompts, and output formats, and runs on a team's own provider keys.

aido-dev.ai: https://aido-dev.ai/

---

Published on Pressando: https://pressando.com/en/organization/aido/aido-1-6-security-hardening