Carrot disclosure: Forgejo — security flaws and the carrot disclosure approach
Summary
The article analyzes Forgejo's security posture after Fedora migrated from Pagure, finding a range of weaknesses (SSRF, missing security headers, weak templating, cryptographic practices, auth gaps, DoS risks, information leaks, TOCTOU). It documents a chain of issues capable of enabling RCE and secret leakage, discusses the carrot disclosure approach to incentivize vendor remediation, and notes the existence of a formal security policy. The piece includes PoC artifacts and a broader argument for holistic security audits of self-hosted development platforms.