chris/dex
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
dex/SECURITY.md
chris c7c0f9b6da Pre-launch: CI, community health files, AGENTS.md, screenshots, OG tags 
- .github/workflows/ci.yml — npm ci + npm run build on push/PR, with the
  PokéAPI snapshot cached so only the first run pays the fetch cost.
- .github/dependabot.yml — weekly npm, monthly actions, grouped.
- .github/ISSUE_TEMPLATE/ — bug report, feature request, config with
  discussion / upstream-data links.
- CODE_OF_CONDUCT.md — Contributor Covenant 2.1 (contact method is a
  placeholder to fill in).
- SECURITY.md — private reporting + the known dev-only Vite/esbuild advisory.
- AGENTS.md — machine-facing version of CONTRIBUTING for AI coding agents.
- docs/screenshots/ + a strip in the README (resized + pngquant'd, ~240 KB).
- public/og.png + Open Graph / Twitter card meta in index.html.
- .nvmrc (20); gitignore .claude/ .idea/ .vscode/.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017Ve7HLspzeG2xDPtJQ8vmu
2026-09-10 11:14:01 -04:00

1.2 KiB
Raw Blame History

Security Policy

Supported versions

Pocketdex is a rolling static web app — only the current main (and whatever is deployed from it) is supported. There are no maintenance branches.

Reporting a vulnerability

Please don't open a public issue for a security problem.

Use GitHub's private vulnerability reporting (the Report a vulnerability button under the repository's Security tab). Include what you found, how to reproduce it, and the impact you think it has. You'll get an acknowledgement as soon as possible.

Since Pocketdex has no backend and stores everything in the visitor's own browser, the realistic surface is: the service worker / caching, the save-file parser (src/lib/savedex.js) operating on untrusted binary input, and the JSON backup import.

Known issues

  • npm audit reports a moderate advisory for esbuild via Vite 5 (GHSA-67mh-4wv8-2f99). It affects the local dev server only — a malicious website could read responses from npm run dev. It is not present in the production build (dist/), which ships no dev server. Mitigation: don't expose the Vite dev server to untrusted networks. Upgrading past Vite 5 needs a newer Node baseline and is tracked as a follow-up.