chris/dex
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
dex/SECURITY.md
chris 671e72972a Apply Prettier to the whole tree 
Pure formatting — no behaviour change. Verified: build passes, all 14
routes render, service worker active, no console errors.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017Ve7HLspzeG2xDPtJQ8vmu
2026-09-10 11:24:31 -04:00

979 B
Raw Blame History

Security Policy

Supported versions

Pocketdex is a rolling static web app — only the current main (and whatever is deployed from it) is supported. There are no maintenance branches.

Reporting a vulnerability

Please don't open a public issue for a security problem.

Use GitHub's private vulnerability reporting (the Report a vulnerability button under the repository's Security tab). Include what you found, how to reproduce it, and the impact you think it has. You'll get an acknowledgement as soon as possible.

Since Pocketdex has no backend and stores everything in the visitor's own browser, the realistic surface is: the service worker / caching, the save-file parser (src/lib/savedex.js) operating on untrusted binary input, and the JSON backup import.

Known issues

None currently. npm audit is clean as of the last dependency bump (Vite 6, esbuild 0.25). CI does not yet gate on npm audit; run it locally when touching dependencies.