gamertan
b68fa2487d
Sanitized root snapshot from private source commit a72903c63e1753f9e6ffbf40453c0830bdfc05c5 and tree 295641e67eef5979da76746d8ae271249568263e. Private development history and workflows are excluded by the exact allowlist. AI-assisted: OpenAI Codex helped implement, test, and audit this preview. Signed-off-by: Cole Speelman <crspeelman@gmail.com>
15 lines
757 B
Markdown
15 lines
757 B
Markdown
# Security policy
|
|
|
|
Report suspected vulnerabilities privately to `security@sandwichhime.com`.
|
|
Please include the affected Tend version, configuration shape, reproduction,
|
|
and expected impact. Do not include production credentials or private logs.
|
|
|
|
Tend treats source repositories, release artifacts, configuration, handwritten
|
|
Caddy templates, and operators as trusted. It treats artifact paths, archives,
|
|
filesystem state, process output, HTTP responses, and deployment targets as
|
|
adversarial inputs. It never evaluates configuration as shell code.
|
|
|
|
The preview is not a sandbox and does not make an untrusted repository safe to
|
|
build. Run `tend package` only for reviewed source. Production configuration
|
|
must be root-owned and kept outside repositories.
|