Teasynaer

// security

Security policy

How to report a vulnerability, what's in scope, and how we handle it.

Supported versions

This project is pre-launch and under active development. There are no formal support guarantees yet; security fixes are handled on a best-effort basis.

Reporting a vulnerability

If you believe you've found a security issue:

  • Do not open a public issue on Forgejo or GitHub.
  • Email: hello@allotmentology.tech
    • Include a short description, steps to reproduce, and any relevant logs or screenshots.
    • If you need to share sensitive details, ask for a preferred secure channel in your first email.

We aim to acknowledge valid reports within 5 business days and to provide a rough remediation plan or next steps within 15 business days.

Infrastructure and hosting

Production runs on Allotment Technology Ltd's self-hosted Hetzner k3s cluster, reachable at teasynaer.dev. Forgejo (git.allotmentology.tech) is the primary git host and CI runner; GitHub is a push-mirror and fallback. Secrets are managed via the cluster's External Secrets Operator + Infisical and are never committed to this repository.

Self-hosted instances run under whatever infrastructure the operator chooses — the guidance above describes Allotment's own deployment (teasynaer.dev), not a requirement for self-hosters.

In-scope areas

Security reports are most helpful when they relate to:

  • Authentication and session handling (local admin, OIDC, forwarded-auth header trust).
  • Access control around test packages, runs, and evidence.
  • Leakage of secrets or credentials in the application, logs, or configuration.
  • Evidence handling: redaction-before-storage, recording upload validation, retention.
  • Issue-tracker adapter credential handling (Huly and future adapters).
  • Host/infrastructure exposure relevant to the reference deployment.
  • Supply-chain issues: malicious or compromised dependencies, secrets committed to the repo, CI workflow poisoning.

Vulnerability management

Reported and scanner-detected vulnerabilities are triaged against severity. CI blocks merges on HIGH/CRITICAL findings from dependency and secret scanning (see .forgejo/workflows/ci.yml).