From a6b1c6dc192a44beef321f8e017925aa6faf7225 Mon Sep 17 00:00:00 2001 From: Eugene Aseev Date: Thu, 24 Sep 2026 13:29:34 +0800 Subject: [PATCH 1/2] docs: point security reports to a private channel; fix the dataset-default line The security doc still called Chainplot an internal tool and sent every finding to the public issue tracker, which publishes an exploitable report before it is fixed. It now points to GitHub's private vulnerability reporting, which is enabled on the repository, and keeps the tracker for everything else. The README said the default release "keeps the data in", two paragraphs after saying the default is `results_only`, which ships no dataset. The wrong clause is gone. "Runs offline" now says it means once dependencies are installed. Co-Authored-By: Claude Opus 5.5 --- README.md | 6 +++--- docs/security.md | 5 +++-- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 8a96991..e3157ed 100644 --- a/README.md +++ b/README.md @@ -192,8 +192,7 @@ Opt in with `--mode dataset_included`, or `policy.release_mode` in the project The 100 MiB cap applies only to the copied dataset, so it never limits the dashboard, and the default never trips it. A project whose parquet is larger than that publishes an identical page with `--mode results_only`; what you give up is the ability for someone -forking it to recompute your numbers from source data, which is why the -default keeps the data in. +forking it to recompute your numbers from source data. ## Fork a published release @@ -301,7 +300,8 @@ with test evidence — including where a criterion was previously asserted too generously — is in [`docs/acceptance.md`](docs/acceptance.md). Requires Node 22+ and pnpm. Ingest additionally needs Docker, an archive RPC -endpoint, and Postgres 16; everything else runs offline. +endpoint, and Postgres 16. Once dependencies are installed, everything else +runs offline. ## Development diff --git a/docs/security.md b/docs/security.md index 409a15c..0456ecf 100644 --- a/docs/security.md +++ b/docs/security.md @@ -88,5 +88,6 @@ run, by this call. ## Reporting -Chainplot is an internal tool. Raise anything you find in the repo's issue -tracker, or directly with the maintainers if it is exploitable. +Report a vulnerability privately through GitHub: the repository's Security +tab → Report a vulnerability. Please do not open a public issue for anything +exploitable. Everything else is welcome in the issue tracker. From e639657ebf9112fedb0f0de7fab15e400f1698ed Mon Sep 17 00:00:00 2001 From: Eugene Aseev Date: Thu, 24 Sep 2026 13:33:38 +0800 Subject: [PATCH 2/2] docs: say which commands need the network MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit "Everything else runs offline" covered publishing to a remote target and `fork --from https://…`, both of which need the network. The line now names what runs offline and what does not. Co-Authored-By: Claude Opus 5.5 --- README.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index e3157ed..1a3bd48 100644 --- a/README.md +++ b/README.md @@ -300,8 +300,9 @@ with test evidence — including where a criterion was previously asserted too generously — is in [`docs/acceptance.md`](docs/acceptance.md). Requires Node 22+ and pnpm. Ingest additionally needs Docker, an archive RPC -endpoint, and Postgres 16. Once dependencies are installed, everything else -runs offline. +endpoint, and Postgres 16. Once dependencies are installed, building, +querying and serving run offline; publishing to a remote target and forking +from a URL need the network. ## Development