Skip to content
Sign up

flagon-io/g1t

public
0

Commit

Security: no bug bounty until g1t makes money, and fixes are welcome as pull requests

Responsible disclosure says why there is no paid bounty yet, and that the source is open: hardening can come straight in as a pull request, while a fix for an open hole is agreed with us first so the pull request does not disclose it. Not built yet no longer says two-factor is missing; it shipped, so the page points to it, and single sign-on is what remains.

syntaqxcommitted Parenteaa719fBrowse files
1 file+10−20/1 viewed
+10−2
6161
6262 ## Not built yet
6363
64−We'd rather tell you than have you assume. **Two-factor authentication and single sign-on are not available yet.** Until they are, use a long, unique password, and review your access tokens and authorized apps in your settings from time to time.
64+We'd rather tell you than have you assume. **Single sign-on is not available yet.** Until it is, turn on [two-factor authentication](/settings/two-factor), and review your access tokens and authorized apps in your settings from time to time.
6565
6666 ## Responsible disclosure
6767
100100 - We'll aim to fix critical problems within 30 days.
101101 - We'll credit you when we publish the fix, if you'd like.
102102
103−g1t doesn't have a paid bug bounty yet.
103+### No bug bounty, yet
104+
105+g1t doesn't pay bug bounties right now. We want to, and we will once g1t is making money to pay them from. Until then, we can offer the credit above and our thanks.
106+
107+### Fixing it yourself
108+
109+g1t is open source, so you can also send the fix. [Its source](/flagon-io/g1t) is on g1t, and changes land through pull requests like anyone else's: see [contributing](/flagon-io/g1t/blob/main/CONTRIBUTING.md).
110+
111+For a vulnerability that isn't fixed yet, **write to us first**: a public pull request shows the problem to everyone before the fix is live. We'll agree with you when to open it. Hardening that doesn't point at an open hole, such as stricter headers, tighter checks or better tests, is welcome as a pull request straight away.
104112
105113 ### Safe harbour
106114