Security

Report a vulnerability in GizStack, Gizlang, GizDB or a hosted app's platform to support@giz.ai with the subject Security. Include the address or command, the steps to reproduce and what you observed. Do not access data that is not yours, and do not degrade the service for other people.

What happens to a report

1. We confirm that we received it.
2. We reproduce the report and tell you whether it is a vulnerability.
3. We fix it, publish the fix in the changelog, and credit you there if you want.

Please let us fix an issue before you publish it.

How GizStack protects your work

• Hosted apps live on their own domain. Apps and previews run under giz.sh, a separate registrable domain, so app code cannot set cookies for or send requests as gizstack.com.
• The console checks every unsafe request. Session cookies are __Host- cookies, and every request that changes state must come from the console's own origin.
• Each app runs isolated. An app has its own process, its own database and its own storage quota. Its environment never contains platform credentials.
• Signed releases. Every release is described by an envelope signed with Ed25519. The installer verifies the signature and each file's SHA-256 digest before it installs anything; see the release catalog.

Scope

In scope: gizstack.com, *.giz.sh, the installer at /install, the Gizlang toolchain and the GizDB server. Out of scope: denial of service, social engineering, and reports from automated scanners without a demonstrated impact.