Security
Report a vulnerability.
Security is an architectural decision at Magogi, and coordinated disclosure keeps it one. Good-faith reports are welcome.
- report security@
- triage acknowledge
- fix remediate
- disclose coordinated
The path a good-faith report walks — first email to public disclosure. We do not publish a response-time promise until it is operationally true.
How to report
Email security@magogi.org. Every address published here is an official Foundation address on the canonical domain. Where you can, include:
- the affected project or component,
- a description of the issue and its impact,
- steps to reproduce, and
- any relevant versions, logs, or proof-of-concept.
What to expect
We aim to acknowledge reports and to work with you on a coordinated disclosure timeline. Please give us reasonable time to investigate and remediate before any public disclosure. A full published policy will live here as the process formalises — we would rather under-promise than post a process we cannot yet honour.
Scope
Reports about the Magogi libraries and this website are in scope; the sooth family is developed privately and a report about it is routed rather than published.
What this site does with your visit
Nothing on this site measures you. It sets no cookie, and the only request your browser makes to anyone but this server is the spam check on the contact page. What is known about a visit is what the web server wrote in its own log while serving it — requests, not people.
What backs this
Two of the estate's controls are checkable in this repository rather than asserted here.
- Every commit must record who authorised it and which model co-wrote it; the gate fails closed, and when it cannot resolve what to check it checks what it can rather than passing vacuously. recorded at build
- This repository is scanned for secrets across its tree and its history, with a pinned scanner version — the same gate the federation runs. recorded at build