Skip to content

docs: private security reporting; fix the dataset-default line #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
easeev merged 2 commits into from
Sep 24, 2026
+7 −5
Merged

docs: private security reporting; fix the dataset-default line #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a6b1c6d
docs: point security reports to a private channel; fix the dataset-de…
easeev Sep 24, 2026
e639657
docs: say which commands need the network
easeev Sep 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -192,8 +192,7 @@ Opt in with `--mode dataset_included`, or `policy.release_mode` in the project
The 100 MiB cap applies only to the copied dataset, so it never limits the
dashboard, and the default never trips it. A project whose parquet is larger than that publishes an identical
page with `--mode results_only`; what you give up is the ability for someone
forking it to recompute your numbers from source data, which is why the
default keeps the data in.
forking it to recompute your numbers from source data.

## Fork a published release

Expand Down Expand Up @@ -301,7 +300,9 @@ with test evidence — including where a criterion was previously asserted too
generously — is in [`docs/acceptance.md`](docs/acceptance.md).

Requires Node 22+ and pnpm. Ingest additionally needs Docker, an archive RPC
endpoint, and Postgres 16; everything else runs offline.
endpoint, and Postgres 16. Once dependencies are installed, building,
querying and serving run offline; publishing to a remote target and forking
from a URL need the network.

## Development

Expand Down
5 changes: 3 additions & 2 deletions docs/security.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,5 +88,6 @@ run, by this call.

## Reporting

Chainplot is an internal tool. Raise anything you find in the repo's issue
tracker, or directly with the maintainers if it is exploitable.
Report a vulnerability privately through GitHub: the repository's Security
tab → Report a vulnerability. Please do not open a public issue for anything
exploitable. Everything else is welcome in the issue tracker.
Loading