RRigfile
Sign in with GitHub

Takedown and abuse policy

Draft for review by a lawyer before launch.

Reporting a rig

Signed-in users can report any rig they can see, using the Report this rig link on its page. Choose a reason (malware, leaked secret, illegal content, abuse, impersonation, other) and describe the problem. To report a security problem in the registry itself, or something you cannot report through the form, write to [SECURITY CONTACT EMAIL].

What we do with a report

  1. An administrator reads it, normally within [N] business days.
  2. If the rig breaks the rules, we remove the affected version(s), or the whole rig for serious cases, and may suspend the publisher. A removed version is unavailable to everyone but administrators; we keep the file and the record for the audit trail and for legal obligations.
  3. For a leaked secret, we remove the version so it stops being served, but you must still revoke the secret: anyone who already downloaded the rig has a copy.
  4. The report is closed as actioned or dismissed. Every step is written to an audit log.

Yanking and removal are different

Yank is done by the publisher: the version is hidden from new resolutions but still downloadable by exact version, so existing lockfiles keep working; people who pull it see a warning. Removal is done by us: the version is unavailable.

Appeals and legal notices

If your rig was removed or your account suspended and you think that was a mistake, write to [CONTACT EMAIL] with the rig name and your reasoning. For copyright or other legal notices, write to [LEGAL CONTACT] and include what is needed for the notice to be valid where you live. [LAWYER: notice-and-takedown procedure for the operator's jurisdiction.]