mirror of https://github.com/hanzoai/gui.git synced 2026-10-23 02:31:31 +00:00

Files

T

zeekay 61a4bc23c9 fix(site): remove external admin allowlist

Empties ADMIN_EMAILS and DEVELOPER_GITHUB_USERNAMES, so the impersonate,
recent-purchases and whitelist routes answer 403 to every caller. Points
security reports and funding at Hanzo.

2026-08-21 12:46:33 -07:00

1.8 KiB

Raw Blame History

Security Policy

Thanks for helping keep Gui and its users safe.

Supported versions

Security fixes are made against the latest published major (hanzogui v2 and the current @hanzogui/* line). Please make sure you can reproduce on the latest release before reporting.

Reporting a vulnerability

Please do not open a public issue for security problems.

Report privately using GitHub's private vulnerability reporting:

Go to the repo's Security tab → Report a vulnerability (https://github.com/hanzoai/gui/security/advisories/new)
Describe the issue, affected versions, and a proof-of-concept if you have one.

If you can't use GitHub advisories, email [email protected] with the details.

We aim to acknowledge reports within 3 business days and to ship a fix or mitigation for confirmed high/critical issues as quickly as we reasonably can. We're happy to credit you in the advisory unless you'd prefer to stay anonymous.

Scope

In scope:

The published @hanzogui/* / hanzogui npm packages.
The gui.hanzo.ai web application and its API endpoints (auth, payments, account/team management).
This repository's CI/CD and release/publish pipeline.

Out of scope:

Vulnerabilities in third-party dependencies that are already publicly known (please report those upstream; Dependabot tracks them here).
Findings that require a compromised developer machine, social engineering, or physical access.
Volumetric / denial-of-service testing against gui.hanzo.ai.

Handling secrets

If you believe a credential has been committed to this repo (current tree or history), treat it as compromised: report it privately as above and do not post the value publicly. Maintainers: rotate the credential at its source first; history scrubbing is secondary.