chris
671e72972a
Pure formatting — no behaviour change. Verified: build passes, all 14 routes render, service worker active, no console errors. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017Ve7HLspzeG2xDPtJQ8vmu
28 lines
979 B
Markdown
28 lines
979 B
Markdown
# Security Policy
|
|
|
|
## Supported versions
|
|
|
|
Pocketdex is a rolling static web app — only the current `main` (and
|
|
whatever is deployed from it) is supported. There are no maintenance
|
|
branches.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Please **don't** open a public issue for a security problem.
|
|
|
|
Use GitHub's **private vulnerability reporting** (the _Report a
|
|
vulnerability_ button under the repository's _Security_ tab). Include what
|
|
you found, how to reproduce it, and the impact you think it has. You'll get
|
|
an acknowledgement as soon as possible.
|
|
|
|
Since Pocketdex has no backend and stores everything in the visitor's own
|
|
browser, the realistic surface is: the service worker / caching, the
|
|
save-file parser (`src/lib/savedex.js`) operating on untrusted binary
|
|
input, and the JSON backup import.
|
|
|
|
## Known issues
|
|
|
|
None currently. `npm audit` is clean as of the last dependency bump
|
|
(Vite 6, esbuild 0.25). CI does not yet gate on `npm audit`; run it
|
|
locally when touching dependencies.
|