For 4,5 years anyone could add rogue JavaScript to SourceHut build log page by submitting a builds.sr.ht job with OSC 8 escape codes. The attacker could submit build jobs on behalf of the victim viewing the build logs, up to even deploying rogue software on the flagship instance. Curious? Read about the whole journey here:

https://blog.arusekk.pl/posts/srht-account-takeover/

#cve_2026_92973 #srht #sourcehut #xss #security #osc8 #ansiescape #ci #vulnerability

My homepage https://ninakalinina.com is now served from #sourcehut.

I need to archive a few old repos on GitHub, and my migration to sr.ht would be finally complete.

Technically, there are alternatives like #Forgejo or #sourcehut, which tend to have most of GitH*b's features, but without the enshittification.

No idea if it'd be worthwhile to use them for Gentoo, though.
I've only used both for personal stuff, with the exception of hosting Forgejo for my group of friends.
I haven't been involved with Gentoo's infrastructure enough to tell :p