chris
c7c0f9b6da
- .github/workflows/ci.yml — npm ci + npm run build on push/PR, with the PokéAPI snapshot cached so only the first run pays the fetch cost. - .github/dependabot.yml — weekly npm, monthly actions, grouped. - .github/ISSUE_TEMPLATE/ — bug report, feature request, config with discussion / upstream-data links. - CODE_OF_CONDUCT.md — Contributor Covenant 2.1 (contact method is a placeholder to fill in). - SECURITY.md — private reporting + the known dev-only Vite/esbuild advisory. - AGENTS.md — machine-facing version of CONTRIBUTING for AI coding agents. - docs/screenshots/ + a strip in the README (resized + pngquant'd, ~240 KB). - public/og.png + Open Graph / Twitter card meta in index.html. - .nvmrc (20); gitignore .claude/ .idea/ .vscode/. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017Ve7HLspzeG2xDPtJQ8vmu
32 lines
1.2 KiB
Markdown
32 lines
1.2 KiB
Markdown
# Security Policy
|
|
|
|
## Supported versions
|
|
|
|
Pocketdex is a rolling static web app — only the current `main` (and
|
|
whatever is deployed from it) is supported. There are no maintenance
|
|
branches.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Please **don't** open a public issue for a security problem.
|
|
|
|
Use GitHub's **private vulnerability reporting** (the *Report a
|
|
vulnerability* button under the repository's *Security* tab). Include what
|
|
you found, how to reproduce it, and the impact you think it has. You'll get
|
|
an acknowledgement as soon as possible.
|
|
|
|
Since Pocketdex has no backend and stores everything in the visitor's own
|
|
browser, the realistic surface is: the service worker / caching, the
|
|
save-file parser (`src/lib/savedex.js`) operating on untrusted binary
|
|
input, and the JSON backup import.
|
|
|
|
## Known issues
|
|
|
|
- **`npm audit` reports a moderate advisory for `esbuild` via Vite 5**
|
|
(GHSA-67mh-4wv8-2f99). It affects the **local dev server only** — a
|
|
malicious website could read responses from `npm run dev`. It is **not**
|
|
present in the production build (`dist/`), which ships no dev server.
|
|
Mitigation: don't expose the Vite dev server to untrusted networks.
|
|
Upgrading past Vite 5 needs a newer Node baseline and is tracked as a
|
|
follow-up.
|