openvibers/openvibe.locker Commits

README first screen, CITATION.cff and SECURITY.md (#29)

OP OpenVibers committed 3 days ago · 6dff2186ee · 3 files, +42 −0

Changes

ddiff --git a/CITATION.cff b/CITATION.cff
nnew file mode 100644
iindex 0000000..03c0ca8
---- /dev/null
++++ b/CITATION.cff
@@@ -0,0 +1,18 @@
++cff-version: 1.2.0
++message: "If you use OpenVibe.Locker in research or a product, cite it as below."
++title: openvibe-locker
++type: software
++authors:
++  - name: OpenVibe
++    alias: OpenVibers
++    website: https://openvibe.network
++repository-code: https://github.com/OpenVibers/OpenVibe.Locker
++url: https://openvibe.locker
++license: AGPL-3.0-only
++abstract: "Private files and expiring Sends, encrypted on your device and unlocked with a passkey, at openvibe.locker."
++keywords:
++  - openvibe
++  - e2ee
++  - encryption
++  - file-sharing
++  - passkey
ddiff --git a/README.md b/README.md
iindex 2bd65b7..787e36b 100644
---- a/README.md
++++ b/README.md
@@@ -5,6 +5,9 @@ The server stores ciphertext and opaque access metadata. It never seals, opens,
  runs AI on content. The cryptographic format and operations are the existing `locker.envelope.v1` and
  `openvibe-sdk/locker`; the device UI and Share sheet are Shared's `ov-locker.js`, `ov-locker-core.js` and `ov-share.js`.
  
++**Live site:** https://openvibe.locker · **API docs:** https://openvibe.services · **For AI:** https://openvibe.locker/llms.txt
++**Run it:** `npm ci && npm start` (Node 22 or newer) · **Tests:** `npm test`
++
  ## Run and verify
  
  `npm ci`, then `npm start`. Without database settings, development uses PGlite in `data/pglite`.
ddiff --git a/SECURITY.md b/SECURITY.md
nnew file mode 100644
iindex 0000000..49b94e7
---- /dev/null
++++ b/SECURITY.md
@@@ -0,0 +1,21 @@
++# Security policy
++
++OpenVibe is run in the open, and we want to hear about security problems before anyone else does.
++
++## Reporting a vulnerability
++
++Email **[email protected]** with "security" in the subject. Please include what you found, where (URL,
++repository, file), how to reproduce it, and what an attacker could do with it. Do not open a public GitHub issue for
++a vulnerability, and do not test against other people's accounts, data or streams.
++
++We reply within 7 days, keep you updated while we fix it, and credit you when the fix ships if you would like.
++
++## Scope
++
++Every OpenVibe service and site (openvibe.live, openvibe.network, openvibe.tools, openvibe.media, openvibe.community,
++openvibe.games and the other openvibe.* domains) and every repository under github.com/OpenVibers. Machine-readable
++contact details are at `/.well-known/security.txt` on each site.
++
++## Supported versions
++
++Only the current `main` branch, which is what runs in production, receives fixes.