Scrub Disclaimer (DRAFT)

⚠️ Draft for review by a qualified attorney. This limits our liability for the automated cleaning step. It is load-bearing — a sold repo that still leaks a secret is the platform's biggest risk.

What "scrubbing" means

When you upload a Submission, Cinderella runs an automated process that:

• Removes files that should never ship (e.g. .env files, database dumps,

private keys, certificates).

• Scans text for secrets (API keys, tokens, private keys) and **personal

data (emails, phone numbers) and redacts** matches.

• Never ingests git history — only the current files — so historical secrets

cannot travel with a Submission.

• Produces a report of everything it removed or redacted.

What scrubbing does NOT mean

• It is not a guarantee. Automated detection can miss novel key formats,

obfuscated secrets, secrets inside binaries or images, or personal data that doesn't match a known pattern.

• It does not verify ownership or licensing of the code.
• It does not make code safe to run. Buyers must review before deploying.

Your responsibilities

• Sellers: remove secrets and personal data *before* uploading, and review

the scrub report and cleaned files before listing. The scrub is a safety net, not your first line of defense.

• Buyers: independently review any purchased Submission for secrets, license

terms, and security before using it.

Human review

High-risk Submissions (where the scrubber flags blocking findings) are held for manual review before they can be listed. {{Describe review SLA + who reviews.}}

Limitation of liability

To the maximum extent permitted by law, Cinderella provides the scrub "as is" and is not liable for any secret, credential, or personal data that survives it. Sellers remain responsible for what they upload; Buyers for what they deploy. {{Insert liability cap tied to fees paid.}}