fosterstack-admin · Oct 9, 2026 · Oct 9, 2026 · Oct 9, 2026
diff --git a/.well-known/security.txt b/.well-known/security.txt
@@ -0,0 +1,6 @@
+Contact: https://github.com/fosterstack/cache/security/advisories/new
+Contact: https://github.com/fosterstack/www/security/advisories/new
+Expires: 2027-10-08T00:00:00.000Z
+Preferred-Languages: en
+Canonical: https://fosterstack.com/.well-known/security.txt
+Policy: https://fosterstack.com/security/
diff --git a/bin/check-file-allowlist.sh b/bin/check-file-allowlist.sh
@@ -29,6 +29,7 @@ ALLOW_PATTERNS=(
   '^favicon-(16|32)\.png$'
   '^apple-touch-icon\.png$'
   '^\.gitignore$'
+  '^\.well-known/security\.txt$'
   '^\.githooks/pre-commit$'
   '^bin/check-file-allowlist\.sh$'
   '^\.github/workflows/[A-Za-z0-9._-]+\.ya?ml$'

diff --git a/security/index.html b/security/index.html
@@ -0,0 +1,136 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Security policy: how to report a vulnerability</title>
+<meta name="description" content="How to report a security problem in FosterStack Cache or this website, what we aim for on fixes, and the signed files we publish with each release.">
+<link rel="canonical" href="https://fosterstack.com/security/">
+<link rel="icon" href="/favicon.svg" type="image/svg+xml">
+<link rel="icon" href="/favicon.ico" sizes="any">
+<link rel="apple-touch-icon" href="/apple-touch-icon.png">
+<style>
+  :root {
+    --bg: #ffffff; --fg: #16181d; --muted: #5b6472; --line: #e4e7ec;
+    --accent: #0d7a5f; --accent-fg: #ffffff; --card: #f6f8f9; --warn-bg: #fff7ed; --warn-line: #fdba74;
+    --mark: #0f4d66;
+  }
+  @media (prefers-color-scheme: dark) {
+    :root {
+      --bg: #101318; --fg: #e8eaf0; --muted: #98a2b3; --line: #262c36;
+      --accent: #2fbf95; --accent-fg: #08110e; --card: #171c23; --warn-bg: #241a10; --warn-line: #7c4a12;
+      --mark: #e8eaf0;
+    }
+  }
+  * { margin: 0; padding: 0; box-sizing: border-box; }
+  body {
+    background: var(--bg); color: var(--fg);
+    font: 16px/1.6 system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
+    -webkit-font-smoothing: antialiased;
+  }
+  main { max-width: 44rem; margin: 0 auto; padding: 0 1.25rem 4rem; }
+  header.site { max-width: 44rem; margin: 0 auto; padding: 1.25rem; display: flex; align-items: baseline; gap: .6rem; }
+  .logo { font-weight: 700; font-size: 1.05rem; letter-spacing: -.01em; }
+  .logo span { color: var(--accent); }
+  .logo .mark { width: 1.2em; height: 1.2em; vertical-align: -.24em; margin-right: .4em; }
+  .tag { color: var(--muted); font-size: .85rem; }
+  .notice {
+    background: var(--warn-bg); border: 1px solid var(--warn-line); border-radius: 8px;
+    padding: .7rem 1rem; font-size: .92rem; margin: 1.5rem 0 2.5rem;
+  }
+  h1 { font-size: 2rem; line-height: 1.2; letter-spacing: -.02em; margin-bottom: 1rem; }
+  .lede { font-size: 1.12rem; color: var(--muted); margin-bottom: 2rem; }
+  h2 { font-size: 1.25rem; margin: 3rem 0 .9rem; letter-spacing: -.01em; }
+  p + p { margin-top: .8rem; }
+  .cards { display: grid; grid-template-columns: repeat(auto-fit, minmax(15rem, 1fr)); gap: .8rem; margin-top: 1rem; }
+  .card { background: var(--card); border: 1px solid var(--line); border-radius: 10px; padding: 1rem 1.1rem; }
+  .card h3 { font-size: .98rem; margin-bottom: .35rem; }
+  .card p { font-size: .9rem; color: var(--muted); }
+  ul.trust { list-style: none; margin-top: .5rem; }
+  ul.trust li { padding: .45rem 0 .45rem 1.6rem; position: relative; }
+  ul.trust li::before { content: "✓"; position: absolute; left: .2rem; color: var(--accent); font-weight: 700; }
+  code, pre { font-family: ui-monospace, "SF Mono", Menlo, monospace; font-size: .88em; }
+  code { background: var(--card); border: 1px solid var(--line); border-radius: 5px; padding: .1em .35em; }
+  pre code { background: none; border: 0; padding: 0; color: inherit; font-size: 1em; }
+  button {
+    padding: .7rem 1.3rem; font-size: 1rem; font-weight: 600; cursor: pointer;
+    background: var(--accent); color: var(--accent-fg); border: 0; border-radius: 8px;
+  }
+  button:disabled { opacity: .6; cursor: default; }
+  table { width: 100%; border-collapse: collapse; font-size: .92rem; margin-top: 1rem; }
+  th, td { text-align: left; padding: .55rem .6rem; border-bottom: 1px solid var(--line); vertical-align: top; }
+  th { font-size: .8rem; text-transform: uppercase; letter-spacing: .04em; color: var(--muted); }
+  pre { background: #0f172a; color: #e2e8f0; padding: .9rem 1rem; border-radius: 8px;
+        overflow-x: auto; font-size: .9rem; line-height: 1.5; }
+  .cta-row { display: flex; gap: .6rem; flex-wrap: wrap; margin-top: 1.1rem; }
+  .btn { display: inline-block; padding: .55rem 1rem; border-radius: 8px; font-weight: 600;
+         text-decoration: none; background: var(--accent); color: #fff; }
+  .btn-secondary { background: transparent; color: inherit; border: 1px solid #cbd5e1; }
+  .muted-note { color: var(--muted); font-size: .93rem; margin-top: 1.1rem; }
+  footer { border-top: 1px solid var(--line); margin-top: 4rem; padding: 1.5rem 1.25rem 3rem; }
+  footer div { max-width: 44rem; margin: 0 auto; color: var(--muted); font-size: .82rem; }
+  a { color: var(--accent); }
+</style>
+</head>
+<body>
+<header class="site">
+  <div class="logo"><svg class="mark" viewBox="0 0 96 96" aria-hidden="true" focusable="false"><rect x="12" y="14" width="72" height="18" rx="5" fill="var(--mark)"/><rect x="12" y="39" width="48" height="18" rx="5" fill="var(--mark)"/><rect x="12" y="64" width="26" height="18" rx="5" fill="var(--accent)"/></svg>foster<span>stack</span></div>
+  <div class="tag">Infrastructure worth keeping — and kept patched.</div>
+</header>
+<main>
+  <h1>Security policy: how to report a vulnerability</h1>
+  <p class="lede">Found a security problem in FosterStack Cache or on this website? Tell us privately. Here is how, what happens next, and what we sign and publish so you can check our work.</p>
+
+  <h2>Report a vulnerability</h2>
+  <ul class="trust">
+    <li>For the cache server and its releases: <a href="https://github.com/fosterstack/cache/security/advisories/new">private vulnerability report on GitHub</a>.</li>
+    <li>For this website: <a href="https://github.com/fosterstack/www/security/advisories/new">private vulnerability report on GitHub</a>.</li>
+    <li>If GitHub's form is not available to you, open an issue that asks for a private channel, with no details in it. We will follow up.</li>
+  </ul>
+  <p>Send the report, not a patch. Please do not post details publicly before a fix ships.</p>
+
+  <h2>What we aim for</h2>
+  <p>We aim to ship fixes for dependency vulnerabilities within 48 hours of public disclosure. That is a target, not a promise you can hold us to. Security patches are never withheld from the free tier: the same fix ships to everyone on the same day.</p>
+  <p>The supported version is the latest minor release.</p>
+
+  <h2>What we sign and publish</h2>
+  <p>Releases are built only in CI. Each one comes with files you can check without an account:</p>
+  <ul class="trust">
+    <li>Container images, signed without a stored key (Sigstore), with build provenance.</li>
+    <li><code>checksums.txt</code> with its own signature file.</li>
+    <li>A software bill of materials (SBOM) for each binary archive.</li>
+    <li>A VEX file saying which known vulnerabilities do and do not affect the release.</li>
+    <li>A <code>release-manifest.json</code> listing every file and its digest.</li>
+  </ul>
+  <p>The commands are under "Verifying a release" in <a href="https://github.com/fosterstack/cache/blob/main/RELEASING.md">RELEASING.md</a>. See also <a href="/how-we-build/">how we build</a>.</p>
+  <p>Every published image is scanned again every day, so a vulnerability disclosed against something we already shipped raises an issue.</p>
+
+  <h2>What the server does with your data</h2>
+  <p>The server sends no telemetry and needs no connection to FosterStack: no usage reporting, no licence check, no update ping. It stores what your build tool sends it, which is cache keys and the files they point to. You can check that it makes no outbound connections, and the command is in the <a href="https://github.com/fosterstack/cache/blob/main/SECURITY.md">security policy</a> on GitHub.</p>
+  <p>This website has no forms, no cookies, no analytics and no third-party requests.</p>
+
+  <h2>What we do not claim</h2>
+  <ul class="trust">
+    <li>The server has a read-write login and an optional read-only login. There is no per-person identity yet.</li>
+    <li>The paid tiers are not built.</li>
+  </ul>
+
+  <p class="muted-note">Machine-readable contact: <a href="/.well-known/security.txt">security.txt</a>.</p>
+  <div class="cta-row">
+    <a class="btn" href="https://github.com/fosterstack/cache/blob/main/SECURITY.md">Full security policy on GitHub</a>
+    <a class="btn btn-secondary" href="/">FosterStack home</a>
+  </div>
+</main>
+<footer>
+  <div>
+    <p>FosterStack is not affiliated with, endorsed by, or sponsored by Gradle Inc.
+    "Gradle" and "Develocity" are trademarks of Gradle Inc., used here only to identify
+    compatibility. FosterStack contains no Gradle Inc. code; it is a clean-room implementation
+    of the documented remote build cache HTTP protocol. Apache Maven is a trademark of the
+    Apache Software Foundation; the Maven Build Cache Extension is Apache's project, not
+    ours.</p>
+    <p style="margin-top:.6rem">© 2026 FosterStack · <a href="/regulated/">For regulated markets</a> · <a href="https://github.com/fosterstack/cache">github.com/fosterstack/cache</a> · <a href="mailto:hello@fosterstack.com">hello@fosterstack.com</a></p>
+  </div>
+</footer>
+</body>
+</html>
diff --git a/sitemap.xml b/sitemap.xml
@@ -16,4 +16,8 @@
     <changefreq>weekly</changefreq>
     <priority>1.0</priority>
   </url>
+  <url>
+    <loc>https://fosterstack.com/security/</loc>
+    <lastmod>2026-10-08</lastmod>
+  </url>
 </urlset>