CRT
79fea16016
Owner-only steps in docs/agents-core.md now include Beta App Review, tester invitations, review replies, price changes and store experiments; personal data stays in .storebound/. README: live-game journey row, TestFlight and After launch command tables, four new skills, MCP 2026-07-28, unverified list. SECURITY: new endpoints.
30 lines
1.8 KiB
Markdown
30 lines
1.8 KiB
Markdown
# Security
|
|
|
|
storebound handles store credentials (a Google Play service account key and an App Store Connect API key) and can
|
|
change live store listings, so security reports matter to me.
|
|
|
|
## Reporting
|
|
|
|
Please do not put details in a public issue. Open an issue titled "security contact" without details, and I will get
|
|
in touch to receive the report privately. I aim to answer within a week and to ship a fix before anything is
|
|
published.
|
|
|
|
## How storebound treats credentials
|
|
|
|
- Credentials come only from environment variables or `.storebound/credentials.json` in your project; `init` adds
|
|
`.storebound/` to `.gitignore`. storebound does not print them or copy them anywhere.
|
|
- The CLI talks to the official store endpoints (`androidpublisher.googleapis.com` and `www.googleapis.com` uploads,
|
|
`oauth2.googleapis.com`, `playdeveloperreporting.googleapis.com` for vitals, `storage.googleapis.com` for your own
|
|
Play reports bucket, `api.appstoreconnect.apple.com` and the upload / analytics download URLs it hands out), Google
|
|
Fonts for `shots fonts`, your own game URL for capture / record, and your own website when `validate` checks the
|
|
privacy policy URL and `app-ads.txt`.
|
|
- The MCP server exposes no tool that submits for review (App Review or Beta App Review), releases, resumes or
|
|
completes a rollout, cancels a submission, deletes anything, invites or removes testers, sends review replies,
|
|
applies prices or starts / stops a store experiment; every write tool is a dry run unless `dry_run: false` is passed.
|
|
- Personal data the CLI handles (tester emails, reviewer names in reply drafts, crash reports, analytics) stays in
|
|
the gitignored `.storebound/`; tester emails are masked in its output.
|
|
- `bun run ci` scrubs the repository for keys, issuer ids, emails and private names before every release.
|
|
|
|
## Supported versions
|
|
|
|
Only the latest release gets fixes.
|