Gist: A critical vulnerability in Gogs enables silent file overwrite and supply-chain compromise through shared LFS storage and missing hash verification. A patch is available, and users should restrict uploads and add integrity checks until upgrading.
Signal reason: It identifies missing verification and storage isolation as capability gaps.
