Site posture and reporting paths.

Reporting

Report a vulnerability.

Use GitHub private vulnerability reporting on the affected repository so details remain private until a fix is available. Please do not disclose security problems in public issues.

• ForgeGuard Kokoro Server — security reporting ↗
• ForgeGuard Faster Whisper Server — security reporting ↗
• ForgeGuard Hermes Agent — security reporting ↗
• ForgeGuard Markdown Live Preview — security reporting ↗

Each project's operational security posture (authentication, TLS, data handling) is documented in its repository under docs/security.md and summarized on its project page here.

This website

How forgeguard.ai is built.

• Static delivery. The site is prebuilt static HTML served by Cloudflare Pages over its global network. There is no server-side code, no database, and no user accounts.
• No third parties at runtime. No analytics, trackers, chat widgets, remote fonts, or CDNs. All assets are served from this origin.
• Build-time content only. Project documentation is imported at build time from pinned commit SHAs; production pages never fetch from GitHub, and imported Markdown is validated and sanitized before it is rendered.
• Security headers. A restrictive Content-Security-Policy is served as a real HTTP response header — inline scripts are allowed only by exact hash, with nounsafe-inline or unsafe-eval for scripts. The site also sendsStrict-Transport-Security, X-Content-Type-Options: nosniff,Referrer-Policy, Permissions-Policy,frame-ancestors 'none', and cross-origin isolation headers. The same CSP is mirrored into a meta element as defense in depth.
• Supply chain. Dependencies are pinned via a committed lockfile, production workflows pin GitHub Actions to immutable commit SHAs, and deployment uses least-privilege workflow permissions.