Puranjay Savar Mattas
8db8e985a7
App Store link: https://apps.apple.com/us/app/outpost-for-outline/id6802736230 README's TestFlight badge replaced with Apple's official "Download on the Mac App Store" badge (docs/assets/mac-app-store-badge.svg, black lockup, from Apple's official marketing badge kit), linked to the real App Store listing. "Early alpha" language dropped from README, CONTRIBUTING.md, SECURITY.md, and both Gitea issue templates - these are now "0.1.x"/"early" rather than "0.0.x"/"alpha", matching the actual release. OutpostVersion.releaseStage is now "" instead of "ALPHA" - About page and the Settings sidebar footer both read through this single source of truth, so this alone drops the "-ALPHA" suffix everywhere it was shown without touching either call site. MARKETING_VERSION bumped 0.0.4 -> 0.1.0 for the Outpost target (Debug + Release) - left OutpostTests/OutpostUITests' MARKETING_VERSION alone, that's just Xcode's unrelated template default for test bundles, never shown to a user. Not compiler-verified - Outpost app target has no CLI build path.
39 lines
1.2 KiB
Markdown
39 lines
1.2 KiB
Markdown
# Security Policy
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
If you discover a security vulnerability in Outpost, please do **not**
|
|
open a public issue.
|
|
|
|
Report it privately to: **security@psmattas.com**
|
|
|
|
Include:
|
|
- A description of the vulnerability
|
|
- Steps to reproduce
|
|
- Potential impact
|
|
- Any suggested fixes if available
|
|
|
|
We will acknowledge receipt within 48 hours and aim to release a fix
|
|
within 14 days depending on severity.
|
|
|
|
## Supported Versions
|
|
|
|
Outpost is early (`0.1.x`) — there's no stable release line yet. Only
|
|
the most recent tagged release receives fixes; please make sure
|
|
you're on the latest release before reporting.
|
|
|
|
| Version | Supported |
|
|
| :--- | :---: |
|
|
| Latest tagged release | ✅ |
|
|
| Older releases | ❌ |
|
|
|
|
## Scope
|
|
|
|
Outpost is a client application that talks to a self-hosted Outline
|
|
instance you control — it doesn't run any server infrastructure of its
|
|
own. Vulnerabilities in Outline itself belong to
|
|
[outline/outline](https://github.com/outline/outline), not this repo.
|
|
API tokens are stored in the system Keychain only (never `UserDefaults`,
|
|
never logged) — see [`CLAUDE.md`](CLAUDE.md) for the relevant
|
|
conventions if you're reviewing that code path.
|