Puranjay Savar Mattas
8db8e985a7
App Store link: https://apps.apple.com/us/app/outpost-for-outline/id6802736230 README's TestFlight badge replaced with Apple's official "Download on the Mac App Store" badge (docs/assets/mac-app-store-badge.svg, black lockup, from Apple's official marketing badge kit), linked to the real App Store listing. "Early alpha" language dropped from README, CONTRIBUTING.md, SECURITY.md, and both Gitea issue templates - these are now "0.1.x"/"early" rather than "0.0.x"/"alpha", matching the actual release. OutpostVersion.releaseStage is now "" instead of "ALPHA" - About page and the Settings sidebar footer both read through this single source of truth, so this alone drops the "-ALPHA" suffix everywhere it was shown without touching either call site. MARKETING_VERSION bumped 0.0.4 -> 0.1.0 for the Outpost target (Debug + Release) - left OutpostTests/OutpostUITests' MARKETING_VERSION alone, that's just Xcode's unrelated template default for test bundles, never shown to a user. Not compiler-verified - Outpost app target has no CLI build path.
1.2 KiB
Security Policy
Reporting a Vulnerability
If you discover a security vulnerability in Outpost, please do not open a public issue.
Report it privately to: security@psmattas.com
Include:
- A description of the vulnerability
- Steps to reproduce
- Potential impact
- Any suggested fixes if available
We will acknowledge receipt within 48 hours and aim to release a fix within 14 days depending on severity.
Supported Versions
Outpost is early (0.1.x) — there's no stable release line yet. Only
the most recent tagged release receives fixes; please make sure
you're on the latest release before reporting.
| Version | Supported |
|---|---|
| Latest tagged release | ✅ |
| Older releases | ❌ |
Scope
Outpost is a client application that talks to a self-hosted Outline
instance you control — it doesn't run any server infrastructure of its
own. Vulnerabilities in Outline itself belong to
outline/outline, not this repo.
API tokens are stored in the system Keychain only (never UserDefaults,
never logged) — see CLAUDE.md for the relevant
conventions if you're reviewing that code path.