HERO FILE is a static, client-rendered app with no backend of its own:
- No accounts, no authentication. There is nothing to log into.
- No server-side storage. Nothing about a visitor is persisted anywhere we
control. The only thing written is an identity lock in the visitor's own
localStorage, which never leaves their browser. - No secrets. The project ships no API keys and requires no environment variables. All GitHub data comes from unauthenticated, public REST endpoints.
- No user-supplied HTML. Profile data is rendered as text; character art is generated from code, not from remote input.
The realistic risk surface is therefore small: dependency vulnerabilities, and bugs in how public GitHub data is handled or displayed.
The main branch is the only supported version. Fixes land there.
Please do not open a public issue for a security problem.
Report it privately via GitHub Security Advisories. Include:
- what the issue is and where in the code it lives,
- how to reproduce it,
- what an attacker could achieve.
You can expect an acknowledgement within a few days. Valid reports will be
fixed on main and credited in the release notes unless you'd rather stay
anonymous.
- GitHub API rate limiting (60 requests/hour for unauthenticated clients). This is a documented platform limit, and the app surfaces it as a normal error message.
- Anything requiring a compromised browser, extension, or machine.
- Missing hardening headers on a third-party deployment you control.