Files

T

zeekay fea2a2612f rebrand: full identifier sweep — @social/ paths, social-* pkgs, zero postiz/gitroom

Complete rebrand. Code now reads as a first-party Hanzo project, not
a forked codebase with upstream identifiers leaking through.

tsconfig path aliases (9 entries):
  @gitroom/backend          → @social/backend
  @gitroom/frontend         → @social/frontend
  @gitroom/helpers          → @social/helpers
  @gitroom/nestjs-libraries → @social/nestjs-libraries
  @gitroom/react            → @social/react
  @gitroom/plugins          → @social/plugins
  @gitroom/orchestrator     → @social/orchestrator
  @gitroom/extension        → @social/extension

Workspace package names (apps/*/package.json):
  postiz-backend       → social-backend
  postiz-frontend      → social-frontend
  postiz-orchestrator  → social-orchestrator
  postiz-extension     → social-extension
  postiz-command       → social-command
  @postiz/node         → @social/node

Swept across 477 files: every import statement, env var (POSTIZ_*→SOCIAL_*),
identifier (featured_by_gitroom→featured_by_social, FEATURED_BY_GITROOM enum
key→FEATURED_BY_SOCIAL), prose mention, FAQ string, and i18n value in all
23 locale JSONs.

Preserved (required by AGPL-3.0): upstream-fork attribution in SECURITY.md,
README.md, CLAUDE.md ("hard fork of gitroomhq/postiz-app"). Required for
license compliance; not used by any code path.

Preserved (external npm dep): @postiz/wallets — this is a published wallet
provider package, not workspace code. We pull it as a normal dependency.

Verification: `grep -riE "postiz|gitroom" --include={ts,tsx,json,mjs,js,md,yaml,yml}`
excluding node_modules + legal docs + i18n.lock returns 0.

2026-06-10 21:39:29 -07:00

1.6 KiB

Raw Permalink Blame History

Security Policy

Hanzo Social is a hard fork of gitroomhq/postiz-app (AGPL-3.0). Upstream security policy still applies to the unforked codebase; this policy covers the Hanzo Social deployment and our additions.

Scope

The fork repository (github.com/hanzoai/social) and the Hanzo Social deployment at https://social.hanzo.ai
Hanzo integration code (KMS sync, IAM client, bot /social surface)
Container images published under ghcr.io/hanzoai/social-{backend,frontend,orchestrator}

For vulnerabilities in upstream code paths we have not modified, prefer reporting to gitroomhq/postiz-app upstream so the broader user base benefits, then notify us so we can patch.

Reporting

Report vulnerabilities privately via the GitHub Security Advisory system on this repo, or email security@hanzo.ai.

When reporting, please include:

A clear description of the vulnerability
Proof of concept (PoC), where possible
Reproduction steps
Impact assessment

AI-generated reports

Reports that appear to be LLM-generated without meaningful human analysis — lacking a working PoC, reproducible steps, or accurate impact assessment — will be closed without detailed response.

AI-assisted reports are welcome when validated by the reporter with a PoC, reproduction steps, and impact assessment.

Response timeline

Acknowledgment within 72 hours.
Triage within 7 days.
Critical fix within 90 days of triage; non-critical within 180 days.
CVE publication within 24 hours of remediation release.