Initial commit on Forgejo

Fresh repository history for elektrine/tarakan hosted at
https://git.elektrine.com/elektrine/tarakan.

lib/tarakan_web/live/page_live/managed_disclosure.html.heex

@@ -0,0 +1,93 @@
+<Layouts.app flash={@flash} current_scope={@current_scope} current_path={assigns[:current_path]}>
+  <Layouts.page width={:focused} class="space-y-8">
+    <header>
+      <h1 class="font-display text-3xl font-medium uppercase leading-[1.05] tracking-[0.02em] text-ink sm:text-4xl">
+        Managed disclosure
+      </h1>
+      <p class="mt-4 max-w-xl text-sm leading-6 text-ink-muted">
+        Managed disclosure is professional handling for vendors: Tarakan staff triage
+        the findings on your repository's public record and run the conversation with
+        you under an agreed response SLA. It changes how findings are handled, never
+        whether they are public.
+      </p>
+    </header>
+
+    <section id="what-it-is" class="border-t-2 border-strong pt-6">
+      <h2 class="font-display text-sm uppercase tracking-[0.12em] text-ink">
+        What it is
+      </h2>
+      <p class="mt-3 max-w-xl text-sm leading-6 text-ink-muted">
+        Tarakan is public disclosure by default: findings appear on the record the
+        moment they are reported. For a vendor, that can mean a stream of public
+        reports arriving before anyone has triaged them. Managed disclosure adds a
+        staffed layer on top of the record:
+      </p>
+      <dl class="mt-4 divide-y divide-rule border-2 border-strong">
+        <div class="px-4 py-3">
+          <dt class="font-mono text-xs uppercase tracking-[0.12em] text-ink">Triage</dt>
+          <dd class="mt-1 text-sm leading-6 text-ink-muted">
+            Staff review new findings on your repositories as they land: deduplicating
+            against known issues, assessing severity and reach, and separating
+            reproducible reports from noise before they consume your team's time.
+          </dd>
+        </div>
+        <div class="px-4 py-3">
+          <dt class="font-mono text-xs uppercase tracking-[0.12em] text-ink">
+            SLA'd response
+          </dt>
+          <dd class="mt-1 text-sm leading-6 text-ink-muted">
+            Every new finding gets a first staff response within an agreed window, and
+            you get a direct channel to the people handling it - no parsing a public
+            feed to learn what matters.
+          </dd>
+        </div>
+        <div class="px-4 py-3">
+          <dt class="font-mono text-xs uppercase tracking-[0.12em] text-ink">
+            Professional handling
+          </dt>
+          <dd class="mt-1 text-sm leading-6 text-ink-muted">
+            Coordinated communication with reporters, recorded vendor-notification
+            dates on each finding, and a single point of contact for escalations,
+            takedown reviews, and disputes.
+          </dd>
+        </div>
+      </dl>
+    </section>
+
+    <section id="and-the-public-record" class="border-t-2 border-strong pt-6">
+      <h2 class="font-display text-sm uppercase tracking-[0.12em] text-ink">
+        Handling, not suppression
+      </h2>
+      <p class="mt-3 max-w-xl text-sm leading-6 text-ink-muted">
+        Managed disclosure never hides a verified finding. The public record is the
+        product: reviews stay public on submission, verification quorum still decides
+        a finding's status, and moderation decisions follow the same
+        <.link navigate={~p"/policies/disclosure"} class="text-signal hover:underline">
+          disclosure policy
+        </.link>
+        for every repository, managed or not. What the service changes is who helps
+        you respond, and how fast. Repositories under managed disclosure carry a
+        public badge saying exactly that.
+      </p>
+    </section>
+
+    <section id="intake" class="border-t-2 border-strong pt-6">
+      <h2 class="font-display text-sm uppercase tracking-[0.12em] text-ink">
+        Intake
+      </h2>
+      <p class="mt-3 max-w-xl text-sm leading-6 text-ink-muted">
+        To put a repository under managed disclosure, write to
+        <a
+          id="managed-disclosure-contact"
+          href={"mailto:#{@security_contact}?subject=Tarakan%20managed%20disclosure"}
+          class="text-signal hover:underline"
+        >
+          {@security_contact}
+        </a>
+        with the repository, your role on the project, and a verification contact.
+        Intake is manual: we confirm you speak for the vendor before anything is
+        enabled.
+      </p>
+    </section>
+  </Layouts.page>
+</Layouts.app>