tarakan/lib/tarakan_web/live/page_live/disclosure.html.heex

<Layouts.app flash={@flash} current_scope={@current_scope} current_path={assigns[:current_path]}>
  <Layouts.page width={:focused} class="space-y-8">
    <header>
      <h1 class="font-display text-3xl font-medium uppercase leading-[1.05] tracking-[0.02em] text-ink sm:text-4xl">
        Disclosure policy
      </h1>
      <p class="mt-4 max-w-xl text-sm leading-6 text-ink-muted">
        Tarakan is a public security record. Reviews are published the moment they are
        submitted; verification and moderation change a record's labels, not its existence.
      </p>
    </header>

    <section id="public-by-default" class="border-t-2 border-strong pt-6">
      <h2 class="font-display text-sm uppercase tracking-[0.12em] text-ink">
        Public by default
      </h2>
      <p class="mt-3 max-w-xl text-sm leading-6 text-ink-muted">
        Every submitted review is public immediately. Submissions are evidence, not verdicts:
        a finding appears on the record as soon as it is reported, and independent reviewers
        confirm, dispute, or mark it fixed in the open. There is no embargo period and no
        private queue between submission and publication.
      </p>
    </section>

    <section id="visibility-levels" class="border-t-2 border-strong pt-6">
      <h2 class="font-display text-sm uppercase tracking-[0.12em] text-ink">
        Visibility levels
      </h2>
      <p class="mt-3 max-w-xl text-sm leading-6 text-ink-muted">
        Visibility is the only content gate. Each review carries one of three levels:
      </p>
      <dl class="mt-4 divide-y divide-rule border-2 border-strong">
        <div class="px-4 py-3">
          <dt class="font-mono text-xs uppercase tracking-[0.12em] text-ink">public</dt>
          <dd class="mt-1 text-sm leading-6 text-ink-muted">
            The default. Full finding details: title, description, file and line references,
            reproduction steps, affected versions, and CWE/CVE identifiers.
          </dd>
        </div>
        <div class="px-4 py-3">
          <dt class="font-mono text-xs uppercase tracking-[0.12em] text-ink">public_summary</dt>
          <dd class="mt-1 text-sm leading-6 text-ink-muted">
            The review exists and counts toward repository headlines, but finding bodies,
            verdict evidence, and notes are withheld from anonymous readers.
          </dd>
        </div>
        <div class="px-4 py-3">
          <dt class="font-mono text-xs uppercase tracking-[0.12em] text-ink">restricted</dt>
          <dd class="mt-1 text-sm leading-6 text-ink-muted">
            A moderation takedown. The review is invisible to anonymous readers; only
            moderators and the submitting account can see it. Restriction exists only as an
            explicit moderation decision, never as a pre-publication state.
          </dd>
        </div>
      </dl>
    </section>

    <section id="verification" class="border-t-2 border-strong pt-6">
      <h2 class="font-display text-sm uppercase tracking-[0.12em] text-ink">
        Verification quorum
      </h2>
      <p class="mt-3 max-w-xl text-sm leading-6 text-ink-muted">
        Findings open as <span class="font-mono text-xs text-ink">open</span>. Independent
        reviewers re-run or re-trace the pinned commit and record checks. When two independent
        checks agree - the quorum threshold - the finding moves to <span class="font-mono text-xs text-ink">verified</span>, <span class="font-mono text-xs text-ink">disputed</span>, or <span class="font-mono text-xs text-ink">fixed</span>. Reviewers cannot verify their
        own submissions. Status labels reflect the record's current consensus; they never hide
        the underlying report.
      </p>
    </section>

    <section id="vendor-notification" class="border-t-2 border-strong pt-6">
      <h2 class="font-display text-sm uppercase tracking-[0.12em] text-ink">
        Vendor notification
      </h2>
      <p class="mt-3 max-w-xl text-sm leading-6 text-ink-muted">
        Because the record is public on submission, maintainers learn about findings at the
        same time as everyone else. Qualified contributors can record the date a vendor was
        notified on each finding page; the recorded date is displayed publicly alongside the
        finding.
      </p>
    </section>

    <section id="abuse" class="border-t-2 border-strong pt-6">
      <h2 class="font-display text-sm uppercase tracking-[0.12em] text-ink">
        Abuse and moderation
      </h2>
      <p class="mt-3 max-w-xl text-sm leading-6 text-ink-muted">
        To report abuse, prohibited content, or a disclosure that endangers someone, file a
        report from any account via the <.link
          navigate={~p"/moderation/report"}
          class="text-signal hover:underline"
        >
          moderation report form
        </.link>. Moderators review reports in a public-interest queue and may restrict
        content or quarantine repositories.
      </p>
    </section>

    <section id="security-contact" class="border-t-2 border-strong pt-6">
      <h2 class="font-display text-sm uppercase tracking-[0.12em] text-ink">
        Security contact
      </h2>
      <p class="mt-3 max-w-xl text-sm leading-6 text-ink-muted">
        To report a vulnerability in Tarakan itself, use the contact published in our
        <a href="/.well-known/security.txt" class="text-signal hover:underline">security.txt</a>
        (RFC 9116).
      </p>
    </section>
  </Layouts.page>
</Layouts.app>