mirror of https://github.com/PerpetualSoftware/pad.git synced 2026-09-24 03:16:43 +00:00

Files

T

Pad — project management for developers and AI agents.
Single Go binary with embedded SvelteKit web UI, SQLite storage,
CLI, and Claude Code /pad skill integration.

https://getpad.dev

2026-03-26 01:52:36 +00:00

1.7 KiB

Raw Blame History

Security Policy

Reporting a Vulnerability

If you discover a security vulnerability in Pad, please do not open a public issue.

Instead, report it privately:

Email: security@perpetualsoftware.org
GitHub: Use GitHub's private vulnerability reporting

Please include:

A description of the vulnerability
Steps to reproduce it
The potential impact
Any suggested fixes (if you have them)

Response Timeline

Acknowledgment: Within 48 hours
Initial assessment: Within 1 week
Fix or mitigation: Depends on severity, but we aim for:
- Critical: 72 hours
- High: 1 week
- Medium/Low: Next release

Scope

Pad runs as a local server on the user's machine. Security concerns include:

Data integrity — Pad stores project data in SQLite; unauthorized modification or deletion is a security issue
Network exposure — Pad binds to localhost by default; any vulnerability that exposes the server to the network unintentionally is in scope
Code injection — Any path where user input (item content, wiki-links, field values) could lead to code execution
Path traversal — Any way to read or write files outside the workspace directory
Embedded web UI — XSS or other web vulnerabilities in the SvelteKit frontend

Out of Scope

Vulnerabilities in dependencies (please report those upstream, but let us know so we can update)
Issues that require physical access to the machine
Social engineering

Supported Versions

We provide security fixes for the latest release only.

Version	Supported
Latest	✅
Older	❌

1.7 KiB Raw Blame History