gamertan
b68fa2487d
Sanitized root snapshot from private source commit a72903c63e1753f9e6ffbf40453c0830bdfc05c5 and tree 295641e67eef5979da76746d8ae271249568263e. Private development history and workflows are excluded by the exact allowlist. AI-assisted: OpenAI Codex helped implement, test, and audit this preview. Signed-off-by: Cole Speelman <crspeelman@gmail.com>
757 B
757 B
Security policy
Report suspected vulnerabilities privately to security@sandwichhime.com.
Please include the affected Tend version, configuration shape, reproduction,
and expected impact. Do not include production credentials or private logs.
Tend treats source repositories, release artifacts, configuration, handwritten Caddy templates, and operators as trusted. It treats artifact paths, archives, filesystem state, process output, HTTP responses, and deployment targets as adversarial inputs. It never evaluates configuration as shell code.
The preview is not a sandbox and does not make an untrusted repository safe to
build. Run tend package only for reviewed source. Production configuration
must be root-owned and kept outside repositories.