Skip to content

Security: hackrepair/rai

Security

SECURITY.md

Security Policy

Repository Boundary

This GitHub repository is intentionally public-safe.

The following categories are intentionally excluded from the tracked repository:

  • Personal Reddit export archives
  • Runtime upload data
  • Generated logs
  • Private planning documents
  • Deployment-only private API implementation
  • Private coding standards material

Supported Layout

This project supports two local run modes:

  • standalone public repo mode using in-repo fallback storage
  • split workspace mode using public/rai plus sibling private/

For the full local development model, sensitive files belong in the sibling private/ workspace, not in the tracked repository.

Supported Use

This project is intended for private, single-user archive workflows. If you deploy it, treat all imported Reddit export data as private user content and keep runtime storage outside version control.

Sensitive Storage Rules

  • Store uploaded Reddit export .zip files only in protected runtime storage such as private/runtime/uploads/ in the split workspace, or storage/uploads/ in standalone fallback mode
  • Store local settings and provider keys only in runtime configuration such as private/runtime/meta/settings.json or local fallback storage, never in tracked source
  • Do not place private archives in assets/
  • Do not commit logs, runtime cache, or user metadata files

Private Runtime Boundary

In the split workspace model, treat the following as local-only:

  • private/.planning/
  • private/api/
  • private/local-assets/
  • private/runtime/

These paths should never be copied into the tracked public/rai tree.

Reporting

If you identify a security issue in the public-safe tracked code, report it privately to the maintainer instead of opening a public issue with exploit details.

For this repository, security-sensitive implementation notes should remain in the local private workspace, not in GitHub issues or pull requests.

There aren't any published security advisories