initial commit

SECURITY.md

@@ -0,0 +1,49 @@
+# Security Policy
+
+## Supported Versions
+
+The project has not shipped a stable release yet. Until the first release, security fixes apply to the main development branch.
+
+## Reporting A Vulnerability
+
+For now, report vulnerabilities privately to the repository owner through the same channel used to access the private Gitea project.
+
+Do not open a public issue for:
+
+- Credential leaks.
+- API key storage flaws.
+- Local data exposure.
+- Remote code execution.
+- Dependency compromise.
+
+## Secret Handling
+
+- Never commit real API keys.
+- Never include real API keys in tests, fixtures, screenshots, logs, or documentation examples.
+- Prefer OS credential storage for Steam and third-party provider keys.
+- If local plaintext storage is temporarily used during early development, it must be clearly marked as temporary and replaced before release.
+- Logs must redact API keys and tokens.
+
+## Local Data
+
+The MVP stores user data locally. Treat the following as sensitive:
+
+- Steam API keys.
+- Third-party metadata API keys.
+- Steam profile identifiers.
+- Imported library data.
+- Recommendation inputs.
+
+The MVP should not collect telemetry.
+
+## Dependencies
+
+- Prefer maintained packages with clear licenses.
+- Validate the terms and maintenance state of any HowLongToBeat-compatible integration before making it core behavior.
+- Avoid scraping or unofficial APIs unless their legal and maintenance risks are documented and accepted.
+
+## Release Security
+
+- Attempt self-signing for desktop artifacts where practical.
+- Keep release artifacts reproducible enough that a maintainer can rebuild them.
+- Do not publish artifacts that contain development credentials or local test data.