mirror of
https://github.com/PerpetualSoftware/pad.git
synced 2026-09-21 10:03:29 +00:00
xarmian
7cda0d7896
Migrates from xarmian/pad to PerpetualSoftware/pad across the entire
repo and updates the product subtitle to "Collaborate with your AI
agents".
Go module rename
- go.mod: github.com/xarmian/pad → github.com/PerpetualSoftware/pad
- All Go imports updated across cmd/pad, internal/{cli,server,store,
models,collections,items,events,metrics,webhooks} (~130 files)
- Test fixtures with the literal repo slug ("xarmian/pad" in JSON
shapes, SSH/HTTPS git URL strings, workspace_context fixtures)
also updated, including the secondary repo entry
(xarmian/pad-web → PerpetualSoftware/pad-web — pad-web was also
moved to the org per branch context)
Docs / config
- README badges, install instructions, brew tap, Docker image, source
build path, sponsor link (sponsor link kept as personal @xarmian)
- Subtitle: "Project management for developers and AI agents." →
"Collaborate with your AI agents." (README, manifests, web layout
meta, .goreleaser homebrew description)
- CONTRIBUTING.md, SECURITY.md, skills/INSTALL.md
- .goreleaser.yaml: homebrew_casks owner, GHCR image, release github
owner, cosign cert-identity regex, comments
- .github/workflows/release.yml: tap/release comments
- deploy/k8s/deployment.yaml: container image
- docs/deployment.md: clone URL
- web/static/{site.webmanifest,manifest.json}: description
- web/src/routes/+layout.svelte: meta description + og:description
Brew tap path is PerpetualSoftware/tap/pad (CamelCase, matches
GitHub user case). GHCR image is ghcr.io/perpetualsoftware/pad
(lowercased per GHCR's URL normalization). CODEOWNERS @xarmian and
FUNDING.yml github: xarmian intentionally retained — those are the
personal maintainer / sponsor account, separate from the org repo.
Verification: go build ./..., go test ./... (all pkgs pass), web
build, and make install all clean (TASK-844, TASK-845).
52 lines
1.8 KiB
Markdown
52 lines
1.8 KiB
Markdown
# Security Policy
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
If you discover a security vulnerability in Pad, **please do not open a public issue.**
|
|
|
|
Instead, report it privately:
|
|
|
|
- **Email:** security@perpetualsoftware.org
|
|
- **GitHub:** Use [GitHub's private vulnerability reporting](https://github.com/PerpetualSoftware/pad/security/advisories/new)
|
|
|
|
Please include:
|
|
|
|
- A description of the vulnerability
|
|
- Steps to reproduce it
|
|
- The potential impact
|
|
- Any suggested fixes (if you have them)
|
|
|
|
## Response Timeline
|
|
|
|
- **Acknowledgment:** Within 48 hours
|
|
- **Initial assessment:** Within 1 week
|
|
- **Fix or mitigation:** Depends on severity, but we aim for:
|
|
- Critical: 72 hours
|
|
- High: 1 week
|
|
- Medium/Low: Next release
|
|
|
|
## Scope
|
|
|
|
Pad runs as a local server on the user's machine. Security concerns include:
|
|
|
|
- **Data integrity** — Pad stores project data in SQLite; unauthorized modification or deletion is a security issue
|
|
- **Network exposure** — outside Docker, Pad binds to localhost by default; in Docker, exposure depends on host-side port publishing, and any vulnerability that widens access beyond the intended deployment is in scope
|
|
- **Code injection** — Any path where user input (item content, wiki-links, field values) could lead to code execution
|
|
- **Path traversal** — Any way to read or write files outside the workspace directory
|
|
- **Embedded web UI** — XSS or other web vulnerabilities in the SvelteKit frontend
|
|
|
|
## Out of Scope
|
|
|
|
- Vulnerabilities in dependencies (please report those upstream, but let us know so we can update)
|
|
- Issues that require physical access to the machine
|
|
- Social engineering
|
|
|
|
## Supported Versions
|
|
|
|
We provide security fixes for the latest release only.
|
|
|
|
| Version | Supported |
|
|
|---------|-----------|
|
|
| Latest | ✅ |
|
|
| Older | ❌ |
|