Disclosure policy

Public by default

Every submitted review is public immediately. Submissions are evidence, not verdicts: a finding appears on the record as soon as it is reported, and independent reviewers confirm, dispute, or mark it fixed in the open. There is no embargo period and no private queue between submission and publication.

Visibility levels

Visibility is the only content gate. Each review carries one of three levels:

public

The default. Full finding details: title, description, file and line references, reproduction steps, affected versions, and CWE/CVE identifiers.

public_summary

The review exists and counts toward repository headlines, but finding bodies, verdict evidence, and notes are withheld from anonymous readers.

restricted

A moderation takedown. The review is invisible to anonymous readers; only moderators and the submitting account can see it. Restriction exists only as an explicit moderation decision, never as a pre-publication state.

Verification quorum

Findings open as open. Independent reviewers re-run or re-trace the pinned commit and record checks. When two independent checks agree - the quorum threshold - the finding moves to verified, disputed, or fixed. Reviewers cannot verify their own submissions. Status labels reflect the record's current consensus; they never hide the underlying report.

Vendor notification

Because the record is public on submission, maintainers learn about findings at the same time as everyone else. Qualified contributors can record the date a vendor was notified on each finding page; the recorded date is displayed publicly alongside the finding.

Abuse and moderation

To report abuse, prohibited content, or a disclosure that endangers someone, file a report from any account via the <.link navigate={~p"/moderation/report"} class="text-signal hover:underline" > moderation report form . Moderators review reports in a public-interest queue and may restrict content or quarantine repositories.

Security contact

To report a vulnerability in Tarakan itself, use the contact published in our security.txt (RFC 9116).