From f901378b52d3e1f939d6f184fbabfebc7df7b58b Mon Sep 17 00:00:00 2001
From: Abdullah Sultan <abdullahmsultan1@gmail.com>
Date: Thu, 6 Aug 2026 12:20:25 -0500
Subject: [PATCH] Say who owns contributed code, the name, and the researcher's
 back
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CONTRIBUTING.md said nothing about licensing, so who owns a merged patch was
whatever the contributor assumed. Contributions are now explicitly MIT and
require a DCO sign-off, enforced by .github/workflows/dco.yml on every
non-merge commit in a PR — a few lines of git and grep rather than a
third-party action.

TRADEMARK.md states what MIT does not cover: the name and the logos. Forks may
say "based on Crosscode"; they may not ship a modified build as Crosscode.
Linked from README.md and CONTRIBUTING.md.

SECURITY.md had a reporting route but no contact alias, no timeline, and no
safe harbor. It now names security@getcrosscode.dev, commits to
acknowledge/assess/update windows honest for a solo maintainer, sets 90-day
coordinated disclosure, and promises good-faith researchers we won't come after
them — which docs/terms.md §4 already gestured at.

LICENSE is unchanged.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Abdullah Sultan <abdullahmsultan1@gmail.com>
---
 .github/pull_request_template.md |  7 ++++
 .github/workflows/dco.yml        | 59 +++++++++++++++++++++++++++
 CONTRIBUTING.md                  | 33 +++++++++++++++
 README.md                        |  7 ++++
 SECURITY.md                      | 69 +++++++++++++++++++++++++++++++-
 TRADEMARK.md                     | 51 +++++++++++++++++++++++
 6 files changed, 224 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/dco.yml
 create mode 100644 TRADEMARK.md

diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index eed08c6..01bbf18 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -16,6 +16,13 @@
 - [ ] `pnpm test:postgres` passes (if you touched service/daemon sync code and
       have a test database configured)
 
+## Licensing
+
+- [ ] Every commit carries a DCO `Signed-off-by` line (`git commit -s`) per the
+      [Developer Certificate of Origin](https://developercertificate.org/), and
+      I'm contributing this under the [MIT License](../LICENSE). See
+      [CONTRIBUTING.md](../CONTRIBUTING.md#licensing-your-contribution).
+
 ## Security / trust-boundary impact
 
 <!-- Does this touch auth, RLS, the shadow ref, the apply rule, the secret
diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml
new file mode 100644
index 0000000..92eaa2c
--- /dev/null
+++ b/.github/workflows/dco.yml
@@ -0,0 +1,59 @@
+name: DCO
+
+on:
+  pull_request:
+
+jobs:
+  # Contributions are MIT licensed and every commit must carry a Signed-off-by line per
+  # the Developer Certificate of Origin (developercertificate.org). CONTRIBUTING.md says
+  # so, but a rule nothing enforces is a rule that quietly stops being true — and the
+  # whole point of the sign-off is that it holds for *every* commit in the history, not
+  # most of them. A few lines of git and grep do this; a third-party action would need
+  # more trust than the job is worth.
+  signoff:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # The default shallow checkout can't see the base commit, so the PR's commit
+          # range wouldn't resolve at all.
+          fetch-depth: 0
+      - name: Every commit is signed off
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+          # Merge commits are skipped: GitHub generates them and there is no author to
+          # certify anything.
+          commits=$(git log --no-merges --format=%H "$BASE_SHA..$HEAD_SHA")
+          if [ -z "$commits" ]; then
+            echo "No non-merge commits in this pull request."
+            exit 0
+          fi
+          missing=0
+          for sha in $commits; do
+            author=$(git show -s --format='%an <%ae>' "$sha")
+            # The DCO is a statement by the author, so the sign-off has to name the
+            # author. A sign-off from someone else certifies nothing about this commit.
+            if git show -s --format=%B "$sha" | grep -qiF "Signed-off-by: $author"; then
+              echo "ok    $(git show -s --format='%h %s' "$sha")"
+            else
+              echo "MISSING $(git show -s --format='%h %s' "$sha")"
+              echo "        expected: Signed-off-by: $author"
+              missing=1
+            fi
+          done
+          if [ "$missing" -ne 0 ]; then
+            cat <<'EOF'
+
+          At least one commit is missing a Signed-off-by line matching its author.
+
+          Fix the most recent commit:   git commit -s --amend
+          Fix the whole branch:         git rebase --signoff origin/main
+          Then force-push.
+
+          See CONTRIBUTING.md, "Licensing your contribution".
+          EOF
+            exit 1
+          fi
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 8abcc6b..d203c10 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -93,6 +93,39 @@ and pull request.
   security model.
 - Do not commit secrets, `.env` files, or real Supabase credentials.
 
+## Licensing your contribution
+
+Crosscode is [MIT licensed](./LICENSE), and everything you contribute is
+licensed under the MIT License too. You keep the copyright in your work; you are
+licensing it, not assigning it. There is no CLA to sign.
+
+To make that explicit on every commit, this project uses the [Developer
+Certificate of Origin](https://developercertificate.org/) (DCO). The DCO is a
+short statement that you wrote the change, or that you have the right to submit
+it under the same licence. Certify it by signing off your commits:
+
+```bash
+git commit -s -m "Your message"
+```
+
+That appends a line to the commit message:
+
+```
+Signed-off-by: Your Name <your.email@example.com>
+```
+
+Use your real name and an email you can be reached at; the name and email must
+match the commit's author. Forgot the sign-off? Fix the last commit with
+`git commit -s --amend`, or a whole branch with
+`git rebase --signoff origin/main`, then force-push.
+
+CI (`.github/workflows/dco.yml`) checks every non-merge commit in a pull request
+for a matching sign-off and fails the PR if one is missing. That check is the
+whole enforcement mechanism — there is no bot to comment and no other gate.
+
+The name and logo are not covered by the MIT License. See
+[TRADEMARK.md](./TRADEMARK.md) for what you can do with them.
+
 ## Reporting bugs and requesting features
 
 Use the issue templates under `.github/ISSUE_TEMPLATE/`. For security
diff --git a/README.md b/README.md
index 5d6213f..2b09c3e 100644
--- a/README.md
+++ b/README.md
@@ -310,3 +310,10 @@ Docs: [architecture](./docs/architecture.md) · [protocol](./docs/protocol.md) 
 ## License
 
 Crosscode is free and open source under the [MIT License](./LICENSE).
+
+## Trademark
+
+The MIT License covers the code. It does not cover the name "Crosscode" or the logos in
+[`assets/`](./assets). Fork it, ship it, write about it — just don't present a modified
+version as Crosscode itself. [TRADEMARK.md](./TRADEMARK.md) has the details, and
+`legal@getcrosscode.dev` handles anything it doesn't cover.
diff --git a/SECURITY.md b/SECURITY.md
index 2543b04..747c02e 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -18,12 +18,77 @@ Preferred: open a private
 repository. This lets maintainers triage and coordinate a fix before any
 details become public.
 
-If you're unable to use Security Advisories, open a confidential GitHub issue
-or contact the maintainers directly instead of filing a public issue.
+If you're unable to use Security Advisories, email
+**security@getcrosscode.dev**. That address reaches the maintainer directly.
+Encrypted mail is not currently supported; if you need it, say so in a first
+message with no details in it and we'll arrange a channel.
 
 Do not open a public issue or PR that discloses an unpatched vulnerability,
 exploit path, or security-sensitive proof of concept.
 
+### What happens next
+
+Crosscode is maintained by one person, so these are honest targets rather than
+a staffed SLA. If a deadline slips you will hear that it slipped, not silence.
+
+- **Acknowledgement within 3 business days.** If you haven't heard anything by
+  then, assume the mail went astray and ping the other channel.
+- **An initial assessment within 10 business days** — whether it reproduces,
+  the severity as we see it, and a rough fix timeline.
+- **Progress updates at least every 14 days** until it's resolved.
+- Fixes ship as fast as the severity warrants. Something that exposes other
+  people's file contents gets fixed and deployed the same week; the hosted
+  service is deployed continuously, so a service-side fix reaches everyone
+  without you doing anything.
+
+### Disclosure
+
+We coordinate disclosure with you.
+
+- Please give us **90 days** from your report before publishing, or until a fix
+  is released, whichever comes first. If we need longer we'll ask and explain
+  why; if we're unresponsive or the issue is being actively exploited, publish
+  — a stalled report is not a reason to leave users exposed.
+- When a fix ships, we publish a GitHub Security Advisory describing the issue
+  and its impact.
+- You'll be credited by name or handle in that advisory unless you'd rather not
+  be. Tell us which you prefer.
+
+### Safe harbor for good-faith research
+
+If you research in good faith under this policy, we will not pursue or support
+any legal action against you, and we will not ask a third party to. Concretely:
+we won't bring a claim under computer-misuse or anti-circumvention law, we won't
+treat your testing as a breach of [docs/terms.md](./docs/terms.md) or of your
+account terms, and we won't terminate your account for it. If a third party
+brings a claim about research that stayed within this policy, we'll make clear
+that it was authorised.
+
+Good faith means, concretely:
+
+- **Test against your own project, your own account, and your own data.** Do
+  not access, modify, or retain another user's file contents, sessions, or
+  account. If you stumble into someone else's data, stop, don't save it, and
+  tell us what you saw so we can assess the exposure.
+- **Don't degrade the service.** No denial of service, no load or stress
+  testing against the hosted service, no spam or social engineering of the
+  maintainer or of any user, no physical attacks on infrastructure.
+- **Use the minimum access needed to demonstrate the issue**, and stop as soon
+  as you've proven it. Proving you can read one row is enough; dumping the
+  table is not.
+- **Report promptly** and keep it private until disclosure is coordinated as
+  described above.
+
+This is the same promise [docs/terms.md](./docs/terms.md) §4 makes: good-faith
+security research on your own project is welcome and is not a breach of the
+terms. Work outside these limits — hitting other users, or degrading the
+service — isn't covered, and nothing here waives the rights of any third party,
+including our hosting providers.
+
+If you're unsure whether something is in bounds, ask at
+security@getcrosscode.dev before you do it. Asking first is always the right
+call and never counts against you.
+
 ### What to include
 
 To help us reproduce and fix the issue quickly, include:
diff --git a/TRADEMARK.md b/TRADEMARK.md
new file mode 100644
index 0000000..e52be6a
--- /dev/null
+++ b/TRADEMARK.md
@@ -0,0 +1,51 @@
+# Crosscode trademark policy
+
+The Crosscode **code** is MIT licensed. The MIT License is a copyright licence:
+it does not grant any rights in the **name** "Crosscode" or in the logos under
+[`assets/`](./assets). Those are separate, and this page says what you can do
+with them. The short version: describe your relationship to Crosscode however
+you like, just don't claim to *be* Crosscode.
+
+## What you can do without asking
+
+- **Fork it and say so.** "Based on Crosscode", "a fork of Crosscode", "derived
+  from Crosscode" — all fine, and encouraged, as long as the name of your
+  project is not itself Crosscode or a name close enough to be mistaken for it.
+- **Redistribute it unmodified.** Packaging or mirroring an unmodified release
+  under the name Crosscode is fine, keeping the MIT licence and copyright
+  notice intact.
+- **Talk about it.** Blog posts, talks, tutorials, reviews, comparisons,
+  benchmarks, "works with Crosscode", "Crosscode vs. X" — ordinary nominative
+  use needs no permission, including where the conclusion is unflattering.
+- **Use the logo to refer to Crosscode**, for example next to a link or in a
+  comparison table, unmodified and not as the primary branding of your thing.
+
+## What we ask you not to do
+
+- **Don't present a modified version as Crosscode.** If you change the code,
+  change the name. A fork that ships broken and calls itself Crosscode costs
+  users their trust in a project they didn't actually run.
+- **Don't use the logo as your own mark**, and don't use it in your project's
+  or company's logo, icon, or wordmark.
+- **Don't imply endorsement, affiliation, or an official relationship** that
+  doesn't exist — "official Crosscode plugin", "Crosscode certified",
+  "Crosscode partner".
+- **Don't register** "Crosscode" or a confusingly similar name as a trademark,
+  domain, package name, or social handle in a way that suggests you are the
+  project.
+
+## Asking for permission
+
+Anything not covered above, ask: **legal@getcrosscode.dev**. Say what you want
+to use and where. Requests that help users find the real project are usually
+easy yeses.
+
+## Status
+
+No Crosscode trademark is registered anywhere today, and registration is
+deferred — Crosscode is a pre-1.0 side project. This policy states what the
+project asks of you; it is not a claim to a registered mark. It may change as
+the project does.
+
+If you think something in this policy is unreasonable, open an issue. It is
+meant to stop impersonation, nothing more.