[01]
Free OSS CLI
Run ForgeGuard yourself and retain the bounded Markdown and JSON evidence. No account or hosted control plane is required.
OPEN SOURCE · v0.2.2APACHE-2.0
// authorized-use security evidence
Know what your Gitea posture actually says.
ForgeGuard is a read-only security posture self-check for one explicitly authorized self-hosted Gitea instance. It produces bounded, repeatable evidence without exploit probes, target discovery, or remote changes.
One target · explicit authorization · read-only GET allowlist · deterministic scoring
[01]
Read-only by design
Exact GET allowlist and no target mutation.
[02]
Truth-bounded output
PASS means only the named checked condition.
[03]
Evidence you can retain
Mechanically generated Markdown and JSON artifacts.
// current OSS scope
Small attack surface. Explicit conclusions.
A normal A–F grade appears only when every core check is assessed. Missing or ambiguous evidence produces N/A — never a fabricated PASS or 100/A.
A ForgeGuard score summarizes only the checks implemented in the installed version. It is not a complete hardening assessment or security guarantee.
Product and version evidence for operator-confirmed Gitea
CVE-2026-27771 affected or fixed version posture
Anonymous OCI registry-root response posture
Repository-browser response on the exact allowlisted path
Anonymous repository and user-search API responses
Deterministic Markdown and JSON reporting with completeness semantics
// install and run
Operator-controlled from the first command.
Install from PyPIv0.2.2
python -m pip install forgeguard Authorized quickstartGITEA
forgeguard scan \\
--url https://git.example.com \\
--authorized \\
--product gitea \\
--format md,json \\
--out ./reports/scan_report.md// commercial path
Free evidence first. Human hardening when you need it.
Commercial work starts with written scope, proof of authorization, and operator-controlled inputs. A remediation engagement is separate from reporting and begins only after explicit approval.
[02]
Paid Hardening Report
Human review of authorized evidence, explicit limitations, prioritized findings, and a practical remediation plan for the agreed Gitea scope.
[03]
Remediation Sprint
Separately authorized changes with a frozen scope, rollback discipline, and before/after verification against the agreed acceptance criteria.
No heavy SaaS or recurring monitoring is being offered at this stage. Scope expansion, external target work, and any change to a customer environment require separate written authorization.
authorized use only
The boundary is part of the product.
Use ForgeGuard only on a Gitea instance you own or are explicitly authorized to assess. The CLI requires an authorization affirmation, while legal authority remains the operator's responsibility.
No Forgejo support in 0.2.2
No registration-posture check in 0.2.2
No exploit proof, target discovery, or mass scanning
No private repository, package, manifest, blob, layer, or content retrieval
No state-changing request to the assessed Gitea instance
No security certification, compromise determination, or complete-security guarantee
Need a decision-ready Gitea hardening report?
Use the contact form to send the instance ownership context, desired scope, and timing. We will freeze the authorized boundary before reviewing evidence or proposing work.
ForgeGuard is not affiliated with Gitea, Forgejo, Codeberg, GitHub, or GitLab.