Runestone is an early local-first POC. It is not production-hardened and should not be exposed to untrusted networks without additional review, authentication, authorization, retention controls, and operational monitoring.
If this repository is public, report suspected vulnerabilities through GitHub private vulnerability reporting if enabled. If that is not available, open a minimal public issue that does not include exploit details, secrets, private logs, SIEM exports, or sensitive evidence.
Please include:
- Affected version or commit.
- High-level impact.
- Reproduction steps using synthetic data.
- Suggested mitigation if known.
Do not include real security evidence in public issues, pull requests, discussions, screenshots, or sample files. Security logs may contain usernames, hostnames, IP addresses, command lines, file paths, investigation details, or customer data.
This repository includes:
- TypeScript type checking.
- Unit tests.
- Production build verification.
- npm dependency audit.
- npm SBOM generation.
- CodeQL analysis for JavaScript and TypeScript.
- Dependabot updates for npm and GitHub Actions.
These checks are a diligence baseline, not a production approval.