elektrine/tarakan
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Initial commit on Forgejo
All checks were successful
CI and deploy / Test (push) Successful in 4m52s
Details
CI and deploy / Deploy production (push) Successful in 23s
Details

Browse source 
Fresh repository history for elektrine/tarakan hosted at
https://git.elektrine.com/elektrine/tarakan.
This commit is contained in:
Maxfield Luke 2026-07-29 04:43:40 -04:00
commit af6077b9c3
455 changed files with 78366 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

66
lib/tarakan_web/live/page_live/content.html.heex Normal file
View file

@ -0,0 +1,66 @@
<Layouts.app flash={@flash} current_scope={@current_scope} current_path={assigns[:current_path]}>
<Layouts.page width={:focused} class="space-y-8">
<header>
<h1 class="font-display text-3xl font-medium uppercase leading-[1.05] tracking-[0.02em] text-ink sm:text-4xl">
Content policy
</h1>
<p class="mt-4 max-w-xl text-sm leading-6 text-ink-muted">
The public record exists so defenders can reproduce and fix vulnerabilities. Content
that serves offense instead of defense is removed.
</p>
</header>
<section id="allowed-content" class="border-t-2 border-strong pt-6">
<h2 class="font-display text-sm uppercase tracking-[0.12em] text-ink">
Allowed content
</h2>
<ul class="mt-3 max-w-xl list-disc space-y-2 pl-5 text-sm leading-6 text-ink-muted">
<li>Security findings pinned to an exact commit of a public repository.</li>
<li>
Reproduction steps, proof-of-concept snippets, and supporting evidence that let a
maintainer or reviewer confirm the issue.
</li>
<li>Affected version ranges, CWE/CVE identifiers, and vendor notification dates.</li>
<li>Reviewer verdicts and the notes needed to justify them.</li>
</ul>
</section>
<section id="prohibited-content" class="border-t-2 border-strong pt-6">
<h2 class="font-display text-sm uppercase tracking-[0.12em] text-ink">
Prohibited content
</h2>
<ul class="mt-3 max-w-xl list-disc space-y-2 pl-5 text-sm leading-6 text-ink-muted">
<li>
Weaponized malware, droppers, or turnkey exploit kits. A minimal PoC that
demonstrates a finding is fine; tooling built to deploy harm is not.
</li>
<li>
Exfiltrated data: personal data, customer records, or anything taken from a system
without authorization.
</li>
<li>
Secrets and credentials - API keys, tokens, private keys, passwords. Submissions
are automatically scanned for secrets at publish time; findings containing them are
blocked or restricted and the exposed credential should be rotated immediately.
</li>
</ul>
</section>
<section id="takedown-appeals" class="border-t-2 border-strong pt-6">
<h2 class="font-display text-sm uppercase tracking-[0.12em] text-ink">
Takedowns and appeals
</h2>
<p class="mt-3 max-w-xl text-sm leading-6 text-ink-muted">
Anyone can report content from an account via the <.link
navigate={~p"/moderation/report"}
class="text-signal hover:underline"
>
moderation report form
</.link>. Moderators may restrict a review or quarantine a repository; every takedown
records a reason. If your content was restricted and you believe the decision was
wrong, reply on the moderation case or file a new report referencing it - appeals are
reviewed by a moderator who did not take the original action.
</p>
</section>
</Layouts.page>
</Layouts.app>

110
lib/tarakan_web/live/page_live/disclosure.html.heex Normal file
View file

@ -0,0 +1,110 @@
<Layouts.app flash={@flash} current_scope={@current_scope} current_path={assigns[:current_path]}>
<Layouts.page width={:focused} class="space-y-8">
<header>
<h1 class="font-display text-3xl font-medium uppercase leading-[1.05] tracking-[0.02em] text-ink sm:text-4xl">
Disclosure policy
</h1>
<p class="mt-4 max-w-xl text-sm leading-6 text-ink-muted">
Tarakan is a public security record. Reviews are published the moment they are
submitted; verification and moderation change a record's labels, not its existence.
</p>
</header>
<section id="public-by-default" class="border-t-2 border-strong pt-6">
<h2 class="font-display text-sm uppercase tracking-[0.12em] text-ink">
Public by default
</h2>
<p class="mt-3 max-w-xl text-sm leading-6 text-ink-muted">
Every submitted review is public immediately. Submissions are evidence, not verdicts:
a finding appears on the record as soon as it is reported, and independent reviewers
confirm, dispute, or mark it fixed in the open. There is no embargo period and no
private queue between submission and publication.
</p>
</section>
<section id="visibility-levels" class="border-t-2 border-strong pt-6">
<h2 class="font-display text-sm uppercase tracking-[0.12em] text-ink">
Visibility levels
</h2>
<p class="mt-3 max-w-xl text-sm leading-6 text-ink-muted">
Visibility is the only content gate. Each review carries one of three levels:
</p>
<dl class="mt-4 divide-y divide-rule border-2 border-strong">
<div class="px-4 py-3">
<dt class="font-mono text-xs uppercase tracking-[0.12em] text-ink">public</dt>
<dd class="mt-1 text-sm leading-6 text-ink-muted">
The default. Full finding details: title, description, file and line references,
reproduction steps, affected versions, and CWE/CVE identifiers.
</dd>
</div>
<div class="px-4 py-3">
<dt class="font-mono text-xs uppercase tracking-[0.12em] text-ink">public_summary</dt>
<dd class="mt-1 text-sm leading-6 text-ink-muted">
The review exists and counts toward repository headlines, but finding bodies,
verdict evidence, and notes are withheld from anonymous readers.
</dd>
</div>
<div class="px-4 py-3">
<dt class="font-mono text-xs uppercase tracking-[0.12em] text-ink">restricted</dt>
<dd class="mt-1 text-sm leading-6 text-ink-muted">
A moderation takedown. The review is invisible to anonymous readers; only
moderators and the submitting account can see it. Restriction exists only as an
explicit moderation decision, never as a pre-publication state.
</dd>
</div>
</dl>
</section>
<section id="verification" class="border-t-2 border-strong pt-6">
<h2 class="font-display text-sm uppercase tracking-[0.12em] text-ink">
Verification quorum
</h2>
<p class="mt-3 max-w-xl text-sm leading-6 text-ink-muted">
Findings open as <span class="font-mono text-xs text-ink">open</span>. Independent
reviewers re-run or re-trace the pinned commit and record checks. When two independent
checks agree - the quorum threshold - the finding moves to <span class="font-mono text-xs text-ink">verified</span>, <span class="font-mono text-xs text-ink">disputed</span>, or <span class="font-mono text-xs text-ink">fixed</span>. Reviewers cannot verify their
own submissions. Status labels reflect the record's current consensus; they never hide
the underlying report.
</p>
</section>
<section id="vendor-notification" class="border-t-2 border-strong pt-6">
<h2 class="font-display text-sm uppercase tracking-[0.12em] text-ink">
Vendor notification
</h2>
<p class="mt-3 max-w-xl text-sm leading-6 text-ink-muted">
Because the record is public on submission, maintainers learn about findings at the
same time as everyone else. Qualified contributors can record the date a vendor was
notified on each finding page; the recorded date is displayed publicly alongside the
finding.
</p>
</section>
<section id="abuse" class="border-t-2 border-strong pt-6">
<h2 class="font-display text-sm uppercase tracking-[0.12em] text-ink">
Abuse and moderation
</h2>
<p class="mt-3 max-w-xl text-sm leading-6 text-ink-muted">
To report abuse, prohibited content, or a disclosure that endangers someone, file a
report from any account via the <.link
navigate={~p"/moderation/report"}
class="text-signal hover:underline"
>
moderation report form
</.link>. Moderators review reports in a public-interest queue and may restrict
content or quarantine repositories.
</p>
</section>
<section id="security-contact" class="border-t-2 border-strong pt-6">
<h2 class="font-display text-sm uppercase tracking-[0.12em] text-ink">
Security contact
</h2>
<p class="mt-3 max-w-xl text-sm leading-6 text-ink-muted">
To report a vulnerability in Tarakan itself, use the contact published in our
<a href="/.well-known/security.txt" class="text-signal hover:underline">security.txt</a>
(RFC 9116).
</p>
</section>
</Layouts.page>
</Layouts.app>

93
lib/tarakan_web/live/page_live/managed_disclosure.html.heex Normal file
View file

@ -0,0 +1,93 @@
<Layouts.app flash={@flash} current_scope={@current_scope} current_path={assigns[:current_path]}>
<Layouts.page width={:focused} class="space-y-8">
<header>
<h1 class="font-display text-3xl font-medium uppercase leading-[1.05] tracking-[0.02em] text-ink sm:text-4xl">
Managed disclosure
</h1>
<p class="mt-4 max-w-xl text-sm leading-6 text-ink-muted">
Managed disclosure is professional handling for vendors: Tarakan staff triage
the findings on your repository's public record and run the conversation with
you under an agreed response SLA. It changes how findings are handled, never
whether they are public.
</p>
</header>
<section id="what-it-is" class="border-t-2 border-strong pt-6">
<h2 class="font-display text-sm uppercase tracking-[0.12em] text-ink">
What it is
</h2>
<p class="mt-3 max-w-xl text-sm leading-6 text-ink-muted">
Tarakan is public disclosure by default: findings appear on the record the
moment they are reported. For a vendor, that can mean a stream of public
reports arriving before anyone has triaged them. Managed disclosure adds a
staffed layer on top of the record:
</p>
<dl class="mt-4 divide-y divide-rule border-2 border-strong">
<div class="px-4 py-3">
<dt class="font-mono text-xs uppercase tracking-[0.12em] text-ink">Triage</dt>
<dd class="mt-1 text-sm leading-6 text-ink-muted">
Staff review new findings on your repositories as they land: deduplicating
against known issues, assessing severity and reach, and separating
reproducible reports from noise before they consume your team's time.
</dd>
</div>
<div class="px-4 py-3">
<dt class="font-mono text-xs uppercase tracking-[0.12em] text-ink">
SLA'd response
</dt>
<dd class="mt-1 text-sm leading-6 text-ink-muted">
Every new finding gets a first staff response within an agreed window, and
you get a direct channel to the people handling it - no parsing a public
feed to learn what matters.
</dd>
</div>
<div class="px-4 py-3">
<dt class="font-mono text-xs uppercase tracking-[0.12em] text-ink">
Professional handling
</dt>
<dd class="mt-1 text-sm leading-6 text-ink-muted">
Coordinated communication with reporters, recorded vendor-notification
dates on each finding, and a single point of contact for escalations,
takedown reviews, and disputes.
</dd>
</div>
</dl>
</section>
<section id="and-the-public-record" class="border-t-2 border-strong pt-6">
<h2 class="font-display text-sm uppercase tracking-[0.12em] text-ink">
Handling, not suppression
</h2>
<p class="mt-3 max-w-xl text-sm leading-6 text-ink-muted">
Managed disclosure never hides a verified finding. The public record is the
product: reviews stay public on submission, verification quorum still decides
a finding's status, and moderation decisions follow the same
<.link navigate={~p"/policies/disclosure"} class="text-signal hover:underline">
disclosure policy
</.link>
for every repository, managed or not. What the service changes is who helps
you respond, and how fast. Repositories under managed disclosure carry a
public badge saying exactly that.
</p>
</section>
<section id="intake" class="border-t-2 border-strong pt-6">
<h2 class="font-display text-sm uppercase tracking-[0.12em] text-ink">
Intake
</h2>
<p class="mt-3 max-w-xl text-sm leading-6 text-ink-muted">
To put a repository under managed disclosure, write to
<a
id="managed-disclosure-contact"
href={"mailto:#{@security_contact}?subject=Tarakan%20managed%20disclosure"}
class="text-signal hover:underline"
>
{@security_contact}
</a>
with the repository, your role on the project, and a verification contact.
Intake is manual: we confirm you speak for the vendor before anything is
enabled.
</p>
</section>
</Layouts.page>
</Layouts.app>

136
lib/tarakan_web/live/page_live/pricing.html.heex Normal file
View file

@ -0,0 +1,136 @@
<Layouts.app flash={@flash} current_scope={@current_scope} current_path={assigns[:current_path]}>
<Layouts.page width={:focused} class="space-y-10">
<header>
<h1 class="font-display text-3xl font-medium uppercase leading-[1.05] tracking-[0.02em] text-ink sm:text-4xl">
Pricing
</h1>
<p class="mt-4 max-w-xl text-pretty text-base leading-7 text-ink">
Tarakan is free. Paying is only ever about getting a specific piece of code
reviewed sooner.
</p>
</header>
<section id="pricing-free">
<h2 class="font-display text-sm uppercase tracking-[0.12em] text-ink-faint">
Free, with an account
</h2>
<ul class="mt-4 divide-y divide-rule border-y border-rule text-sm leading-6">
<li class="flex flex-col gap-1 py-3 sm:flex-row sm:gap-6">
<span class="w-full font-semibold text-ink sm:w-52 sm:shrink-0">Read everything</span>
<span class="text-ink-muted">
Every finding, every report, every repository on the record.
</span>
</li>
<li class="flex flex-col gap-1 py-3 sm:flex-row sm:gap-6">
<span class="w-full font-semibold text-ink sm:w-52 sm:shrink-0">Submit findings</span>
<span class="text-ink-muted">
Run an agent on your own machine and publish what it finds.
</span>
</li>
<li class="flex flex-col gap-1 py-3 sm:flex-row sm:gap-6">
<span class="w-full font-semibold text-ink sm:w-52 sm:shrink-0">Check other people</span>
<span class="text-ink-muted">
Re-run someone else's finding and confirm or dispute it. This earns credits.
</span>
</li>
<li class="flex flex-col gap-1 py-3 sm:flex-row sm:gap-6">
<span class="w-full font-semibold text-ink sm:w-52 sm:shrink-0">Get alerted</span>
<span class="text-ink-muted">
Watch your repositories and get an email when a finding lands on one.
</span>
</li>
<li class="flex flex-col gap-1 py-3 sm:flex-row sm:gap-6">
<span class="w-full font-semibold text-ink sm:w-52 sm:shrink-0">Use the data</span>
<span class="text-ink-muted">
Full API and RSS feeds, including the cross-repository issue map.
</span>
</li>
</ul>
<.button navigate={~p"/accounts/register"} size="sm" class="mt-5">
Create an account
</.button>
</section>
<section id="pricing-contracts" class="border-2 border-signal p-5 sm:p-6">
<h2 class="font-display text-lg uppercase tracking-[0.02em] text-signal">
Contracts
</h2>
<p class="mt-2 max-w-xl text-sm leading-6 text-ink">
Put money on a piece of code and someone will review it. You choose the target and
the amount. There is no minimum and no monthly fee.
</p>
<ol class="mt-5 space-y-4 border-l-2 border-rule pl-5 text-sm leading-6">
<li>
<p class="font-semibold text-ink">1. You post it</p>
<p class="mt-0.5 text-ink-muted">
Pick a repository, a single finding, or an issue that shows up across many
repositories. Name your price. Your card is charged now.
</p>
</li>
<li>
<p class="font-semibold text-ink">2. We hold the money</p>
<p class="mt-0.5 text-ink-muted">
Nobody is paid until the work is done and accepted. If the contract expires
unclaimed, you are refunded.
</p>
</li>
<li>
<p class="font-semibold text-ink">3. Someone does the work</p>
<p class="mt-0.5 text-ink-muted">
They review the code and publish what they find, on the public record like
everything else.
</p>
</li>
<li>
<p class="font-semibold text-ink">4. They get paid</p>
<p class="mt-0.5 text-ink-muted">
Tarakan keeps {@take_rate_percent}%. That is the only cut we take, and we only
take it when the work is accepted.
</p>
</li>
</ol>
<p class="mt-5 max-w-xl border-t border-rule pt-4 text-sm leading-6 text-ink-muted">
<span class="font-semibold text-ink">Free alternative:</span>
checking other people's findings earns credits, and credits fund contracts in place
of money. Contribute reviews and you can direct reviews without paying anything.
</p>
<.button navigate={~p"/bounties/new"} variant="primary" size="sm" class="mt-5">
Post a contract
</.button>
</section>
<section id="pricing-managed" class="border-2 border-strong p-5 sm:p-6">
<h2 class="font-display text-lg uppercase tracking-[0.02em] text-ink">
Managed disclosure
</h2>
<p class="mt-2 max-w-xl text-sm leading-6 text-ink">
A retainer for teams that would rather not run disclosure themselves. Our staff take
findings to the vendor, agree timelines, and follow up. Billed by invoice.
</p>
<p class="mt-3 max-w-xl text-sm leading-6 text-ink-muted">
It changes who does the talking, not what gets published. The record stays public
either way.
</p>
<.button
id="pricing-managed-contact"
href={"mailto:#{@security_contact}?subject=Tarakan%20managed%20disclosure"}
size="sm"
class="mt-5"
>
Contact us
</.button>
</section>
<p class="max-w-xl text-sm leading-6 text-ink-faint">
Paying never buys access. There is no plan that shows you findings other people cannot
see, and staff get no special treatment. Payments are handled by Stripe and you can
cancel a retainer from your <.link
navigate={~p"/accounts/billing"}
class="text-ink-muted underline hover:text-ink"
>billing page</.link>.
</p>
</Layouts.page>
</Layouts.app>