fixy worky security
4 files+73−70/4 viewed
| 1 | + | # Security | |
| 2 | + | ||
| 3 | + | If you've found a security problem in g1t, please tell us privately at | |
| 4 | + | **[hey@flagon.io](mailto:hey@flagon.io)** rather than in an issue, a pull | |
| 5 | + | request or a chat channel. Our | |
| 6 | + | [security.txt](https://g1t.sh/.well-known/security.txt) says the same. | |
| 7 | + | ||
| 8 | + | The full policy, with what's in and out of scope, is at | |
| 9 | + | [g1t.sh/security](https://g1t.sh/security#responsible-disclosure). This file | |
| 10 | + | is the short version. | |
| 11 | + | ||
| 12 | + | ## What to send | |
| 13 | + | ||
| 14 | + | What you found, where, how to reproduce it, and what an attacker could do | |
| 15 | + | with it. Screenshots, requests or a short proof of concept help. Please | |
| 16 | + | don't include other people's data. | |
| 17 | + | ||
| 18 | + | ## What we promise | |
| 19 | + | ||
| 20 | + | - We'll acknowledge your report within **2 business days**, give you our | |
| 21 | + | assessment within **5 business days**, and keep you updated at least every | |
| 22 | + | 14 days until it's fixed. | |
| 23 | + | - We aim to fix critical problems within 30 days. | |
| 24 | + | - We'll credit you when we publish the fix, if you'd like. | |
| 25 | + | ||
| 26 | + | We ask for 90 days, or until a fix ships, whichever comes first, before you | |
| 27 | + | share the problem publicly. We'll agree a date with you. | |
| 28 | + | ||
| 29 | + | ## Supported versions | |
| 30 | + | ||
| 31 | + | g1t.sh is deployed continuously from `main`, so a fix reaches it as soon as | |
| 32 | + | it lands. For the CLI, the runner, the desktop and mobile apps, and | |
| 33 | + | self-hosted installs, fixes ship in the next release: keep to the latest one. | |
| 34 | + | ||
| 35 | + | ## The rules | |
| 36 | + | ||
| 37 | + | - Test only against accounts and workspaces you own, or have the owner's | |
| 38 | + | permission to test. | |
| 39 | + | - Don't access, change or delete other people's data beyond the minimum | |
| 40 | + | needed to show the problem, and stop and tell us as soon as you've reached | |
| 41 | + | any. | |
| 42 | + | - Don't degrade g1t for others: no denial of service, load testing or spam, | |
| 43 | + | and no cryptocurrency miners, even to test detection. | |
| 44 | + | ||
| 45 | + | If you act in good faith and follow the policy, we consider your research | |
| 46 | + | authorized and won't pursue legal action against you for it. The | |
| 47 | + | [safe harbour](https://g1t.sh/security#safe-harbour) section says exactly | |
| 48 | + | what that covers. | |
| 49 | + | ||
| 50 | + | ## Sending a fix | |
| 51 | + | ||
| 52 | + | For a vulnerability that isn't fixed yet, **write to us first**: a public | |
| 53 | + | pull request shows the problem to everyone before the fix is live, so we'll | |
| 54 | + | agree with you when to open it. Hardening that doesn't point at an open hole, | |
| 55 | + | such as stricter headers, tighter checks or better tests, is welcome as a | |
| 56 | + | pull request straight away; see [CONTRIBUTING.md](CONTRIBUTING.md). | |
| 57 | + | ||
| 58 | + | g1t doesn't pay bug bounties yet. We will once it's making money to pay them | |
| 59 | + | from; until then, we offer credit and our thanks. |
| 36 | 36 | variants: { | |
| 37 | 37 | variant: { | |
| 38 | 38 | line: "h-11 border-b-2 border-transparent px-1 hover:border-line-strong aria-[current=page]:border-accent", | |
| 39 | − | pill: "h-8 rounded-md px-3 hover:bg-raised/60 aria-[current=page]:bg-raised", | |
| 39 | + | pill: "h-9 rounded-md px-3.5 font-medium hover:bg-raised/60 aria-[current=page]:bg-raised", | |
| 40 | 40 | }, | |
| 41 | 41 | soon: { | |
| 42 | 42 | true: "text-faint hover:text-muted", |
| 170 | 170 | const tab = (value: State, label: string) => ( | |
| 171 | 171 | <Link | |
| 172 | 172 | to={link(value)} | |
| 173 | + | aria-current={state === value ? "page" : undefined} | |
| 173 | 174 | className={ | |
| 174 | − | "rounded-md px-3 py-1.5 text-sm transition-colors " + | |
| 175 | + | "inline-flex h-full items-center rounded-[5px] px-2.5 text-sm transition-colors " + | |
| 175 | 176 | (state === value ? "bg-raised font-medium text-fg" : "text-muted hover:text-fg") | |
| 176 | 177 | } | |
| 177 | 178 | > | |
| ⋯ | |||
| 180 | 181 | ); | |
| 181 | 182 | return ( | |
| 182 | 183 | <div className="flex flex-wrap items-center justify-between gap-3"> | |
| 183 | − | <Card tone="plain" radius="lg" className="flex gap-1 p-1"> | |
| 184 | + | {/* A filter, the height of the filters beside it: the section's views above it outweigh it. */} | |
| 185 | + | <Card tone="plain" radius="lg" className="flex h-8 gap-0.5 rounded-md p-0.5"> | |
| 186 | + | ||
| 184 | 187 | {tab("open", "Open")} | |
| 185 | 188 | {tab("closed", "Closed")} | |
| 186 | 189 | </Card> | |
| 140 | 140 | /** | |
| 141 | 141 | * The views of the section the page is in (Files, Commits and the rest | |
| 142 | 142 | * under Code, and so on), at the top of the page's content: a secondary | |
| 143 | − | * row that belongs to what is under it, not a second header. Soon tabs | |
| 144 | − | * open their roadmap page, under the same tabs. | |
| 143 | + | * row that belongs to what is under it, not a second header. It runs the | |
| 144 | + | * content's width on a rule of its own, so it heads everything below it | |
| 145 | + | * and outweighs the filters there. Soon tabs open their roadmap page, | |
| 146 | + | * under the same tabs. | |
| 145 | 147 | */ | |
| 146 | 148 | function PageTabs({ base, tabs }: { base: string; tabs: PageTab[] }) { | |
| 147 | 149 | const { pathname } = useLocation(); | |
| ⋯ | |||
| 149 | 151 | const current = (tab: PageTab) => | |
| 150 | 152 | [tab.path, ...(tab.also ?? [])].some((path) => rest === path || (!tab.exact && rest.startsWith(`${path}/`))); | |
| 151 | 153 | return ( | |
| 152 | − | <NavTabs label="Views" variant="pill" className="mb-6"> | |
| 154 | + | <div className="mb-6 border-b border-line pb-3"> | |
| 155 | + | <NavTabs label="Views" variant="pill"> | |
| 153 | 156 | {tabs.map((tab) => ( | |
| 154 | 157 | <Hint key={tab.path} label={tab.about}> | |
| 155 | 158 | <NavTab variant="pill" to={`${base}/${tab.path}`} current={current(tab)} soon={tab.soon}> | |
| ⋯ | |||
| 157 | 160 | </NavTab> | |
| 158 | 161 | </Hint> | |
| 159 | 162 | ))} | |
| 160 | − | </NavTabs> | |
| 163 | + | </NavTabs> | |
| 164 | + | </div> | |
| 161 | 165 | ); | |
| 162 | 166 | } | |
| 163 | 167 | ||