SORN GIT
Security

Security policy

SORN GIT holds people's source code, so we take reports seriously and fix them first. Found a problem? Tell us privately.

A developer reviewing code on two monitors late in the evening

Reporting a problem

Please don't open a public issue. Email info@amiplay.com with "SORN GIT security" in the subject, and include what you found and how to reproduce it (the version from sorngit version helps), what an attacker could do with it, and whether you'd like to be credited.

Our promise: a reply within 3 working days (Bangkok time). Please give us 90 days to release a fix before publishing details; we'll often be much faster, and we'll agree a date with you.

What happens next

  1. We confirm the problem and work out which versions are affected.
  2. We fix it and publish a signed release. Servers with automatic updates on (the default) install it the following night.
  3. We publish a short advisory: what was wrong, who was affected and what to do, crediting you unless you'd rather not be named.

Only the newest release gets security fixes; automatic updates keep servers on it.

In scope

  • The sorngit server: web interface, Git over HTTPS and SSH, Git LFS, the admin area, backups, mirrors, updates and email alerts.
  • The installer at get.sorngit.com/install and the release signatures.
  • This website, sorngit.com.

Out of scope: attacks that already need root on the server, denial of service by sheer traffic volume, hardening of the operating system SORN GIT runs on (it reports those with sudo sorngit doctor), and social engineering.

Testing safely

Test only against a SORN GIT server you installed yourself. Don't access other people's data or degrade a service for others, and stop and tell us once you've shown a problem exists. If you follow this policy in good faith, we won't pursue legal action over your research.

No backdoors, no secret calls home

SORN GIT has no backdoor, no hidden account, no master password, no hidden script and no tracking. Nobody at Amiplay can sign in to your server, and SORN GIT never sends your code or data to us or to any cloud you didn't choose. The code is open source, so you don't have to take our word for it.

These are the only connections it makes to other machines:

  • Let's Encrypt: To get and renew your HTTPS certificate. Only when you give SORN GIT a domain.
  • get.sorngit.com: Checks for new signed releases once every 48 hours. A plain download: it sends nothing about you, your users or your code. Updates are signed, and you can turn automatic installs off.
  • Your email server: Security notices and alerts. Only if you set one up.
  • Your off-site storage: Nightly backups, encrypted on your server first with a key only you hold. Only if you set it up.
  • Addresses you enter: Imports and mirrors you create yourself, and nothing else.

How SORN GIT protects itself

  • Sign-in: Argon2id password hashing, two-factor codes with replay protection, optional passkeys, lock-out after repeated failures, a password re-check before sensitive actions.
  • Admin area: opens from your network, listed addresses, or after a fresh two-factor check; a passkey can be required.
  • Web: strict Content-Security-Policy, cross-origin request protection, secure cookies, sanitized README rendering, sandboxed raw files.
  • Git: user-supplied names are never read as options; SSH keys are restricted to Git only; pushes containing well-known secrets are refused.
  • Outbound connections for imports, mirrors and off-site backups can't reach the server itself or your local network.
  • Audit log: every entry is chained to the one before, so edits or deletions are detected.
  • Updates and backups: signed releases with automatic rollback; off-site backups encrypted with a key only you hold.