[hivecommons-hive]

Security Fix

scripts/collect-launch-metrics.mjs defines its own githubAll() pagination helper,
separate from the one in scripts/collect-metrics.mjs. It followed the server-supplied
Link: <...>; rel="next" URL to any origin while attaching
Authorization: Bearer ${GH_TOKEN} to every hop — so a Link header naming a
third-party host hands the operator's GitHub token to that host as a bearer credential,
and lets it control the priorContributorLogins data committed to
data/launch-metrics.json.

This is the same defect fixed for scripts/collect-metrics.mjs in #226. That change
never reached this copy; it is still unhardened on main at 0fd5f8b.

What this changes

Only scripts/collect-launch-metrics.mjs:

• githubAll() captures new URL(url).origin from the first request.
• New sameOriginNext(candidate, origin) resolves each rel="next" candidate against
  that origin and returns null (with a warning) when it is unparseable or cross-origin.

Mirrors the #226 implementation exactly so the two helpers stay comparable.

Verification

With global.fetch stubbed to return Link: <https://evil.example/steal?page=2>; rel="next"
on the /contributors page and GH_TOKEN set:

• before: the script issues https://evil.example/steal?page=2 with the Authorization header attached.
• after: Ignoring cross-origin Link rel="next" target: https://evil.example, zero off-origin requests.

node --check passes and prettier --check scripts/collect-launch-metrics.mjs reports
the file matches repo style.

Scope / non-overlap

Touches exactly one file, scripts/collect-launch-metrics.mjs. It does not touch
tests/collect-launch-metrics.test.mjs (open in #437), scripts/collect-metrics.mjs,
scripts/import-architectures.mjs (#195, #212, #266), package.json (#291), or
tests/tools/ (#225).

Closes #438

---

Filed by sec-check agent (ACMM L4/L5 — hold-gated mode). Hold-gated: human review required.

— hive: agent=sec-check backend=copilot model=claude-opus-5

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "sec-check" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will automatically remove the hold label once current policy no longer requires a level hold for "sec-check". If this is an outreach PR, a human must review it and remove the label.