mirror of https://github.com/PerpetualSoftware/pad.git synced 2026-09-10 23:15:40 +00:00

Files

T

xarmian 7cda0d7896 feat: rebrand to Perpetual Software + new tagline (IDEA-832) (#273 )

Migrates from xarmian/pad to PerpetualSoftware/pad across the entire
repo and updates the product subtitle to "Collaborate with your AI
agents".

Go module rename
- go.mod: github.com/xarmian/pad → github.com/PerpetualSoftware/pad
- All Go imports updated across cmd/pad, internal/{cli,server,store,
  models,collections,items,events,metrics,webhooks} (~130 files)
- Test fixtures with the literal repo slug ("xarmian/pad" in JSON
  shapes, SSH/HTTPS git URL strings, workspace_context fixtures)
  also updated, including the secondary repo entry
  (xarmian/pad-web → PerpetualSoftware/pad-web — pad-web was also
  moved to the org per branch context)

Docs / config
- README badges, install instructions, brew tap, Docker image, source
  build path, sponsor link (sponsor link kept as personal @xarmian)
- Subtitle: "Project management for developers and AI agents." →
  "Collaborate with your AI agents." (README, manifests, web layout
  meta, .goreleaser homebrew description)
- CONTRIBUTING.md, SECURITY.md, skills/INSTALL.md
- .goreleaser.yaml: homebrew_casks owner, GHCR image, release github
  owner, cosign cert-identity regex, comments
- .github/workflows/release.yml: tap/release comments
- deploy/k8s/deployment.yaml: container image
- docs/deployment.md: clone URL
- web/static/{site.webmanifest,manifest.json}: description
- web/src/routes/+layout.svelte: meta description + og:description

Brew tap path is PerpetualSoftware/tap/pad (CamelCase, matches
GitHub user case). GHCR image is ghcr.io/perpetualsoftware/pad
(lowercased per GHCR's URL normalization). CODEOWNERS @xarmian and
FUNDING.yml github: xarmian intentionally retained — those are the
personal maintainer / sponsor account, separate from the org repo.

Verification: go build ./..., go test ./... (all pkgs pass), web
build, and make install all clean (TASK-844, TASK-845).

2026-04-28 12:26:39 -04:00

1.8 KiB

Raw Permalink Blame History

Security Policy

Reporting a Vulnerability

If you discover a security vulnerability in Pad, please do not open a public issue.

Instead, report it privately:

Email: security@perpetualsoftware.org
GitHub: Use GitHub's private vulnerability reporting

Please include:

A description of the vulnerability
Steps to reproduce it
The potential impact
Any suggested fixes (if you have them)

Response Timeline

Acknowledgment: Within 48 hours
Initial assessment: Within 1 week
Fix or mitigation: Depends on severity, but we aim for:
- Critical: 72 hours
- High: 1 week
- Medium/Low: Next release

Scope

Pad runs as a local server on the user's machine. Security concerns include:

Data integrity — Pad stores project data in SQLite; unauthorized modification or deletion is a security issue
Network exposure — outside Docker, Pad binds to localhost by default; in Docker, exposure depends on host-side port publishing, and any vulnerability that widens access beyond the intended deployment is in scope
Code injection — Any path where user input (item content, wiki-links, field values) could lead to code execution
Path traversal — Any way to read or write files outside the workspace directory
Embedded web UI — XSS or other web vulnerabilities in the SvelteKit frontend

Out of Scope

Vulnerabilities in dependencies (please report those upstream, but let us know so we can update)
Issues that require physical access to the machine
Social engineering

Supported Versions

We provide security fixes for the latest release only.

Version	Supported
Latest	✅
Older	❌

1.8 KiB Raw Permalink Blame History