ZacharyZhang-NYandClaude Opus 5
9fb82291b2
The canonical repo is git.zacharyzhang.com now, so every URL a user can actually reach had to move with it. Self-updater: `PRODUCTION_ENDPOINTS.update_base_url` targets Gitea's `/api/v1/repos/.../releases`, which serves the same wire format GitHub's releases API did — `Release`/asset deserialisation is unchanged. The alpha channel requests `?per_page=30&limit=30` because GitHub reads the page size from `per_page` and Gitea from `limit`, and each ignores the other's, so one URL stays correct on either. Installers: same API base, and the documented one-liners become `https://kigicli.dev/install.{sh,ps1}`. That domain's Worker proxies both files from Gitea raw `main`, so the published install command survives any future forge move without being reprinted everywhere. install.ps1 also drops the GitHub-specific `Accept: application/vnd.github+json`. Everything else user-facing: `/feedback` and the shell's feedback fallback point at the Gitea issue tracker, `/docs` at the Gitea-rendered README, and web_fetch's User-Agent at kigicli.dev. SECURITY.md now routes reports to the issue tracker with a warning to withhold exploitable detail, because Gitea has no equivalent of GitHub's private vulnerability reporting. Comments naming `.github/workflows/release.yml` name `.gitea/` now. Tests assert against these constants rather than literal URLs, so they follow automatically; the one URL-shape assertion (production endpoints are https) still holds. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
11 lines
470 B
Markdown
11 lines
470 B
Markdown
# Security Policy
|
|
|
|
Kigi is a community build; report vulnerabilities on the
|
|
[Kigi issue tracker](https://git.zacharyzhang.com/ZacharyZhang-NY/Kigi-CLI/issues).
|
|
Issues there are public, so please leave out any detail that would make a
|
|
report directly exploitable — open with the affected area and impact, and a
|
|
maintainer will follow up for the rest.
|
|
|
|
Dependency advisories are gated in CI with `cargo deny check advisories`;
|
|
documented exceptions live in `deny.toml`.
|