2d8be6f0dd
Documentation & licensing: - Add the EUPL-1.2 licence (LICENSE.md) and set the project licence; refresh the README (name origin wink, updated feature list, documentation index). - Add CONTRIBUTING, SECURITY, CODE_OF_CONDUCT, CHANGELOG, AUTHORS, and THIRD_PARTY_NOTICES, plus docs/ (ARCHITECTURE, BUILD, USER_GUIDE, SHORTCUTS, LICENSE_COMPLIANCE) and .github/ (CI workflow, issue/PR templates). - Bring docs/FILE_FORMAT.md in line with current behaviour (code & chart slides, per-slide TLP comment, annotation .ink.json sidecar, chart data/ CSVs). Open-source compliance: - Add tool/check_licenses.dart and a `make licenses` target (wired into check-full and CI) that verifies every resolved dependency uses a recognised open-source licence. A scan of all 151 packages and bundled assets found only OSI-approved licences. Charts (Fase 1.1): - Replace the chart CSV textarea with an in-app editable data grid (editable series/labels/values, add/remove row & column, read-only when linked). - Centralize the linked-CSV directory name (`data/`) in a shared constant. Also normalize formatting repo-wide with `dart format` and fix one curly-braces lint, so `make check` and CI are green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
1.7 KiB
Security Policy
Reporting a vulnerability
Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.
Instead, report them privately via GitHub's "Report a vulnerability" button under the repository's Security tab (Security Advisories). If that is not available to you, contact the maintainer directly and wait for a reply before disclosing anything publicly.
When reporting, please include as much of the following as you can:
- A description of the issue and its impact.
- Steps to reproduce (a minimal deck or input file if relevant).
- The OciDeck version, operating system, and Flutter version.
- Any proof-of-concept, logs, or screenshots.
What to expect
- Acknowledgement of your report as quickly as we reasonably can.
- An assessment and, where confirmed, a fix developed under coordinated (responsible) disclosure.
- Credit for the discovery if you wish — let us know how you would like to be named.
We ask that you give us a reasonable opportunity to address the issue before any public disclosure, and that you avoid privacy violations, data destruction, or service disruption while researching.
Scope notes
OciDeck is an offline desktop application. Areas of particular interest:
- Parsing of untrusted decks (
.md), packages (.ocideck), sidecars (.ink.json, captions), and linked CSV data. - Importing presentations from a URL.
- The HTML export, which inlines third-party JavaScript (marked, highlight.js, mermaid, MathJax) to render offline.
Supported versions
Security fixes target the latest released version and the default development branch. Older versions may not receive fixes.