Maxfield Luke
af6077b9c3
Fresh repository history for elektrine/tarakan hosted at https://git.elektrine.com/elektrine/tarakan.
93 lines
4.3 KiB
Text
93 lines
4.3 KiB
Text
<Layouts.app flash={@flash} current_scope={@current_scope} current_path={assigns[:current_path]}>
|
|
<Layouts.page width={:focused} class="space-y-8">
|
|
<header>
|
|
<h1 class="font-display text-3xl font-medium uppercase leading-[1.05] tracking-[0.02em] text-ink sm:text-4xl">
|
|
Managed disclosure
|
|
</h1>
|
|
<p class="mt-4 max-w-xl text-sm leading-6 text-ink-muted">
|
|
Managed disclosure is professional handling for vendors: Tarakan staff triage
|
|
the findings on your repository's public record and run the conversation with
|
|
you under an agreed response SLA. It changes how findings are handled, never
|
|
whether they are public.
|
|
</p>
|
|
</header>
|
|
|
|
<section id="what-it-is" class="border-t-2 border-strong pt-6">
|
|
<h2 class="font-display text-sm uppercase tracking-[0.12em] text-ink">
|
|
What it is
|
|
</h2>
|
|
<p class="mt-3 max-w-xl text-sm leading-6 text-ink-muted">
|
|
Tarakan is public disclosure by default: findings appear on the record the
|
|
moment they are reported. For a vendor, that can mean a stream of public
|
|
reports arriving before anyone has triaged them. Managed disclosure adds a
|
|
staffed layer on top of the record:
|
|
</p>
|
|
<dl class="mt-4 divide-y divide-rule border-2 border-strong">
|
|
<div class="px-4 py-3">
|
|
<dt class="font-mono text-xs uppercase tracking-[0.12em] text-ink">Triage</dt>
|
|
<dd class="mt-1 text-sm leading-6 text-ink-muted">
|
|
Staff review new findings on your repositories as they land: deduplicating
|
|
against known issues, assessing severity and reach, and separating
|
|
reproducible reports from noise before they consume your team's time.
|
|
</dd>
|
|
</div>
|
|
<div class="px-4 py-3">
|
|
<dt class="font-mono text-xs uppercase tracking-[0.12em] text-ink">
|
|
SLA'd response
|
|
</dt>
|
|
<dd class="mt-1 text-sm leading-6 text-ink-muted">
|
|
Every new finding gets a first staff response within an agreed window, and
|
|
you get a direct channel to the people handling it - no parsing a public
|
|
feed to learn what matters.
|
|
</dd>
|
|
</div>
|
|
<div class="px-4 py-3">
|
|
<dt class="font-mono text-xs uppercase tracking-[0.12em] text-ink">
|
|
Professional handling
|
|
</dt>
|
|
<dd class="mt-1 text-sm leading-6 text-ink-muted">
|
|
Coordinated communication with reporters, recorded vendor-notification
|
|
dates on each finding, and a single point of contact for escalations,
|
|
takedown reviews, and disputes.
|
|
</dd>
|
|
</div>
|
|
</dl>
|
|
</section>
|
|
|
|
<section id="and-the-public-record" class="border-t-2 border-strong pt-6">
|
|
<h2 class="font-display text-sm uppercase tracking-[0.12em] text-ink">
|
|
Handling, not suppression
|
|
</h2>
|
|
<p class="mt-3 max-w-xl text-sm leading-6 text-ink-muted">
|
|
Managed disclosure never hides a verified finding. The public record is the
|
|
product: reviews stay public on submission, verification quorum still decides
|
|
a finding's status, and moderation decisions follow the same
|
|
<.link navigate={~p"/policies/disclosure"} class="text-signal hover:underline">
|
|
disclosure policy
|
|
</.link>
|
|
for every repository, managed or not. What the service changes is who helps
|
|
you respond, and how fast. Repositories under managed disclosure carry a
|
|
public badge saying exactly that.
|
|
</p>
|
|
</section>
|
|
|
|
<section id="intake" class="border-t-2 border-strong pt-6">
|
|
<h2 class="font-display text-sm uppercase tracking-[0.12em] text-ink">
|
|
Intake
|
|
</h2>
|
|
<p class="mt-3 max-w-xl text-sm leading-6 text-ink-muted">
|
|
To put a repository under managed disclosure, write to
|
|
<a
|
|
id="managed-disclosure-contact"
|
|
href={"mailto:#{@security_contact}?subject=Tarakan%20managed%20disclosure"}
|
|
class="text-signal hover:underline"
|
|
>
|
|
{@security_contact}
|
|
</a>
|
|
with the repository, your role on the project, and a verification contact.
|
|
Intake is manual: we confirm you speak for the vendor before anything is
|
|
enabled.
|
|
</p>
|
|
</section>
|
|
</Layouts.page>
|
|
</Layouts.app>
|