Security Policy and Coordinated Disclosure

Scope

This document covers vulnerabilities in ArchForge's hosted service, authorization logic, Git Smart HTTP, APIs, webhooks, account flows and official desktop distribution channels. It is not a grant of permission to test third-party websites, private repositories or other users' accounts.

Reporting vulnerabilities

Contact Jeffrey Vels privately with a concise summary, affected endpoint or version, reproduction steps, impact and any safe proof of concept. Do not post exploitable details, keys or affected personal data publicly. If the reporting mailbox is unavailable, use the legally identified contact channel in the Legal Notice.

Rules for responsible testing

Use only accounts and assets you own or have explicit authorization to test. Avoid denial of service, credential stuffing, persistence, data extraction or modification, social engineering and uncontrolled scanning. Stop testing if you encounter real personal data, private user content or production instability, and notify the operator. Legal permission for testing is not inferred from the existence of this document.

How reports are handled

Acknowledgment, prioritization and remediation depend on severity and operational capability. **Our platform is committed to addressing security vulnerabilities and incidents in a timely and responsible manner.

We aim to acknowledge security reports within 48 hours of receipt.

Critical security incidents that pose an immediate risk to user data or platform integrity are prioritized and investigated as soon as reasonably possible.

High-severity vulnerabilities are targeted for remediation within 7 days, while medium- and low-severity issues are addressed according to their risk and impact.

These response times are operational targets and not guaranteed resolution deadlines.

Where a personal data breach is subject to mandatory notification requirements under the GDPR, we will notify the relevant supervisory authority within the applicable legal timeframe, including the 72-hour requirement where applicable.

Users affected by a high-risk personal data breach will be notified without undue delay where legally required.** should be published only after realistic internal response procedures are established. Reporter identity will be shared only to the extent needed and permitted by law. Public credit is optional and requires the reporter's agreement.

Accounts, keys and releases

Users should enable supported 2FA and keep PATs and SSH private keys safe. Repository maintainers should review Git commit history for inadvertently committed secrets. Official release signatures must be checked against a separately authenticated trusted public key; do not assume a downloaded checksum alone proves authenticity.

Changes and version history

This policy applies from its stated effective date once published. Material changes are dated and versioned. Earlier versions remain available to administrators for audit, and any notice or renewed agreement required by applicable law is handled separately. Questions and legally valid notices may be sent using the contact details in the Legal Notice.