Security

Reporting a vulnerability

Email security@gitfor.dev with a description, steps to reproduce and the impact you observed. You can also open a private security advisory on the source repository. Please do not file public issues for vulnerabilities. Our security.txt lists the same contact.

What we promise

• We acknowledge reports within 3 business days and keep you updated until it is resolved.
• We credit you in the fix announcement if you want to be credited.
• We will not pursue or support legal action against good-faith research that follows this policy, and we consider it authorized under anti-hacking laws and our terms.

Rules of engagement

• Only test against accounts and repositories you own or have explicit permission to use.
• Do not access, change or delete other users' data; stop and report as soon as you see any.
• Do not run cryptocurrency miners, scanners against third parties or high-volume traffic.
• Give us reasonable time to fix the issue before disclosing it publicly; we aim for 90 days or less.

In scope

• The hosted forge and its API, Git and LFS endpoints.
• Isolation between accounts, repositories, CI jobs, editor containers and Sites.
• Authentication: sessions, passkeys, two-factor, tokens, OAuth and GitHub sign-in.
• The open-source code in the gitfor repository.

Out of scope

• Content users host on Sites or in repositories (report that as abuse).
• Denial of service, load testing, spam or social engineering of staff or users.
• Findings that need a compromised device, or only affect outdated browsers.
• Missing best-practice headers or rate limits without a demonstrated impact.
• Vulnerabilities in Cloudflare, Stripe or GitHub themselves; report those to the vendor.

We do not currently run a paid bug bounty.