| 1 | # Security |
| 2 | |
| 3 | If you've found a security problem in g1t, please tell us privately at |
| 4 | **[hey@flagon.io](mailto:hey@flagon.io)** rather than in an issue, a pull |
| 5 | request or a chat channel. Our |
| 6 | [security.txt](https://g1t.sh/.well-known/security.txt) says the same. |
| 7 | |
| 8 | The full policy, with what's in and out of scope, is at |
| 9 | [g1t.sh/security](https://g1t.sh/security#responsible-disclosure). This file |
| 10 | is the short version. |
| 11 | |
| 12 | ## What to send |
| 13 | |
| 14 | What you found, where, how to reproduce it, and what an attacker could do |
| 15 | with it. Screenshots, requests or a short proof of concept help. Please |
| 16 | don't include other people's data. |
| 17 | |
| 18 | ## What we promise |
| 19 | |
| 20 | - We'll acknowledge your report within **2 business days**, give you our |
| 21 | assessment within **5 business days**, and keep you updated at least every |
| 22 | 14 days until it's fixed. |
| 23 | - We aim to fix critical problems within 30 days. |
| 24 | - We'll credit you when we publish the fix, if you'd like. |
| 25 | |
| 26 | We ask for 90 days, or until a fix ships, whichever comes first, before you |
| 27 | share the problem publicly. We'll agree a date with you. |
| 28 | |
| 29 | ## Supported versions |
| 30 | |
| 31 | g1t.sh is deployed continuously from `main`, so a fix reaches it as soon as |
| 32 | it lands. For the CLI, the runner, the desktop and mobile apps, and |
| 33 | self-hosted installs, fixes ship in the next release: keep to the latest one. |
| 34 | |
| 35 | ## The rules |
| 36 | |
| 37 | - Test only against accounts and workspaces you own, or have the owner's |
| 38 | permission to test. |
| 39 | - Don't access, change or delete other people's data beyond the minimum |
| 40 | needed to show the problem, and stop and tell us as soon as you've reached |
| 41 | any. |
| 42 | - Don't degrade g1t for others: no denial of service, load testing or spam, |
| 43 | and no cryptocurrency miners, even to test detection. |
| 44 | |
| 45 | If you act in good faith and follow the policy, we consider your research |
| 46 | authorized and won't pursue legal action against you for it. The |
| 47 | [safe harbour](https://g1t.sh/security#safe-harbour) section says exactly |
| 48 | what that covers. |
| 49 | |
| 50 | ## Sending a fix |
| 51 | |
| 52 | For a vulnerability that isn't fixed yet, **write to us first**: a public |
| 53 | pull request shows the problem to everyone before the fix is live, so we'll |
| 54 | agree with you when to open it. Hardening that doesn't point at an open hole, |
| 55 | such as stricter headers, tighter checks or better tests, is welcome as a |
| 56 | pull request straight away; see [CONTRIBUTING.md](CONTRIBUTING.md). |
| 57 | |
| 58 | g1t doesn't pay bug bounties yet. We will once it's making money to pay them |
| 59 | from; until then, we offer credit and our thanks. |