# ForgeGuard by Gexiro

> Read-only, deterministic security posture evidence for one explicitly authorized self-hosted Gitea instance.

Canonical product page: https://gexiro.com/forgeguard
Source code: https://github.com/gexiro-global/forgeguard
Python package: https://pypi.org/project/forgeguard/
Current public release described here: https://github.com/gexiro-global/forgeguard/releases/tag/v0.2.2
License: Apache-2.0
Version described: 0.2.2
Last reviewed: 2026-08-20

## What ForgeGuard is

ForgeGuard is an open-source CLI for an operator who owns a self-hosted Gitea instance or has explicit authorization to assess it. The CLI uses a fixed read-only GET allowlist and produces deterministic Markdown and JSON reports. It does not need a hosted account or a remote control plane.

Install from PyPI:

    python -m pip install forgeguard

Authorized example:

    forgeguard scan --url https://git.example.com --authorized --product gitea --format md,json --out ./reports/scan_report.md

## Evidence implemented in 0.2.2

- Operator-confirmed Gitea product and version evidence.
- CVE-2026-27771 affected-or-fixed version posture.
- Anonymous OCI registry-root response posture.
- Response posture on the exact allowlisted repository-browser path.
- Anonymous repository and user-search API responses.
- Deterministic Markdown and JSON reporting with completeness semantics.

A normal A–F grade appears only when every core check is assessed. Missing or ambiguous core evidence produces N/A. A score summarizes only the checks implemented in the installed ForgeGuard version.

## Explicit boundaries in 0.2.2

- Gitea is supported; Forgejo is not supported.
- Registration posture is not checked.
- No exploit proof, target discovery, or mass scanning.
- No private repository, package, manifest, blob, layer, or content retrieval.
- No state-changing request to the assessed instance.
- No security certification, compromise determination, complete hardening assessment, or security guarantee.
- Use is limited to an instance the operator owns or is explicitly authorized to assess.

## Public evidence

- Release 0.2.2: https://github.com/gexiro-global/forgeguard/releases/tag/v0.2.2
- Synthetic before/after example: https://github.com/gexiro-global/forgeguard/blob/main/docs/BEFORE_AFTER_EXAMPLE.md
- Package index: https://pypi.org/project/forgeguard/
- Repository: https://github.com/gexiro-global/forgeguard

The public synthetic example is evidence of report semantics, not evidence from a customer or an external target.

## Commercial path

1. Free OSS CLI: the authorized operator runs ForgeGuard and retains the bounded output.
2. Paid Hardening Report: a separately scoped human review of authorized evidence, explicit limitations, prioritized findings, and a practical remediation plan.
3. Remediation Sprint: separately authorized changes with frozen scope, rollback discipline, and before/after verification against agreed acceptance criteria.

Recurring monitoring and a heavy hosted SaaS are not currently offered.

## Contact and authorization

ForgeGuard Hardening Report inquiry form: https://gexiro.com/en?subject=forgeguard#contact
General Gexiro inquiry form: https://gexiro.com/en#contact

The website publishes no direct e-mail intake link for ForgeGuard inquiries. Use the ForgeGuard form and include instance ownership context, the desired scope, timing, and proof that the work is authorized. No external target work or environment change begins without a separately agreed written boundary.