CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions
storebound/SECURITY.md
CRT 79fea16016 0.4.0: changelog, version, README (journey, commands, skills, MCP, safety, FAQ, roadmap), agent rules, adapters 
Owner-only steps in docs/agents-core.md now include Beta App Review, tester invitations, review replies, price changes
and store experiments; personal data stays in .storebound/. README: live-game journey row, TestFlight and After launch
command tables, four new skills, MCP 2026-07-28, unverified list. SECURITY: new endpoints.
2026-10-10 23:30:48 +08:00

1.8 KiB
Raw Blame History

Security

storebound handles store credentials (a Google Play service account key and an App Store Connect API key) and can change live store listings, so security reports matter to me.

Reporting

Please do not put details in a public issue. Open an issue titled "security contact" without details, and I will get in touch to receive the report privately. I aim to answer within a week and to ship a fix before anything is published.

How storebound treats credentials

  • Credentials come only from environment variables or .storebound/credentials.json in your project; init adds .storebound/ to .gitignore. storebound does not print them or copy them anywhere.
  • The CLI talks to the official store endpoints (androidpublisher.googleapis.com and www.googleapis.com uploads, oauth2.googleapis.com, playdeveloperreporting.googleapis.com for vitals, storage.googleapis.com for your own Play reports bucket, api.appstoreconnect.apple.com and the upload / analytics download URLs it hands out), Google Fonts for shots fonts, your own game URL for capture / record, and your own website when validate checks the privacy policy URL and app-ads.txt.
  • The MCP server exposes no tool that submits for review (App Review or Beta App Review), releases, resumes or completes a rollout, cancels a submission, deletes anything, invites or removes testers, sends review replies, applies prices or starts / stops a store experiment; every write tool is a dry run unless dry_run: false is passed.
  • Personal data the CLI handles (tester emails, reviewer names in reply drafts, crash reports, analytics) stays in the gitignored .storebound/; tester emails are masked in its output.
  • bun run ci scrubs the repository for keys, issuer ids, emails and private names before every release.

Supported versions

Only the latest release gets fixes.