import { createFileRoute } from "@tanstack/react-router";
import { LegalPage, LegalSection, MailLink } from "~/components/legal/LegalPage";
import { getLegalInfo } from "~/fns/legal";
import { SOURCE_URL } from "~/lib/marketing/site";
import { ExternalLink } from "~/ui/TextLink";
import { seo } from "~/utils/seo";
export const Route = createFileRoute("/security")({
loader: () => getLegalInfo(),
head: ({ match }) => ({
meta: seo({
origin: match.context.publicUrl,
path: "/security",
title: "Security and vulnerability disclosure · gitfor",
description: "How to report a security vulnerability in gitfor, and what we promise in return.",
}),
}),
component: SecurityPolicyPage,
});
const IN_SCOPE = [
"The hosted forge and its API, Git and LFS endpoints.",
"Isolation between accounts, repositories, CI jobs, editor containers and Sites.",
"Authentication: sessions, passkeys, two-factor, tokens, OAuth and GitHub sign-in.",
"The open-source code in the gitfor repository.",
] as const;
const OUT_OF_SCOPE = [
"Content users host on Sites or in repositories (report that as abuse).",
"Denial of service, load testing, spam or social engineering of staff or users.",
"Findings that need a compromised device, or only affect outdated browsers.",
"Missing best-practice headers or rate limits without a demonstrated impact.",
"Vulnerabilities in Cloudflare, Stripe or GitHub themselves; report those to the vendor.",
] as const;
const RULES = [
"Only test against accounts and repositories you own or have explicit permission to use.",
"Do not access, change or delete other users' data; stop and report as soon as you see any.",
"Do not run cryptocurrency miners, scanners against third parties or high-volume traffic.",
"Give us reasonable time to fix the issue before disclosing it publicly; we aim for 90 days or less.",