CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions
storebound/docs/safety.md
CRT 710c3a53d0 README, docs and site: one story (the whole job, no avoidable rejections, the desktop app, your AI, install) 
README is a short front page (about 120 lines) with one real visual per section; every former section moved
unchanged into docs/*.md with a docs/README.md index (journey, rejections, getting-started, commands, growth,
studios, store-art, listing-languages, api, skills, mcp, safety, faq, project). The site tells the same story on one
page: the teaser in the hero, real CLI output as text, the desktop app as a section with light/dark captures of eight
screens and the per-system downloads (desktop/latest.json); /desktop/ redirects to /#download. New capture tools:
tools/site-desktop-shots.ts (fixture-mode desktop frames) and tools/site-term-shots.ts (real CLI output as text and
WebP). tests/docs-links.test.ts checks README, docs and site links resolve.
2026-10-13 03:29:59 +08:00

2 KiB
Raw Blame History

Safety model

  • Credentials live in env vars or the gitignored .storebound/credentials.json, never in the config or the repo. storebound only talks to the official store APIs (plus Google Fonts, your own Play reports bucket and your own URLs); see SECURITY.md.
  • Dry run everywhere. Every write command takes --dry; every MCP write tool has dry_run, default true. Raw API writes (storebound api) are dry unless --yes is given in an interactive terminal; owner-only operations also need the operation id typed, and MCP only gets the read-only api_get.
  • Nothing public or irreversible through an agent. Submitting for review (App Review and Beta App Review), releasing a version, production releases, resuming or completing a rollout or phased release, canceling a submission, deleting, inviting or removing testers, sending review replies, applying prices and starting or stopping a product page test and creating custom offer codes are not MCP tools. Subscription syncs through MCP only create what is new; price changes of live subscriptions wait for a terminal run. They stay terminal commands that ask for confirmation, and the skills tell every agent to ask the owner first (docs/agents-core.md).
  • Personal data stays local. Tester lists, the App Review demo account, reply drafts, health reports and analytics snapshots live in the gitignored .storebound/ (the demo account is masked in every log line); tester emails are masked in every log line, and the config refuses a tester CSV path outside .storebound/.
  • Idempotent writes. Re-running a command converges (MD5 checks for screenshots and previews, one Play edit per language), so a failed upload is fixed by running it again.
  • Simulators and emulators: storebound shuts down only a simulator it booted itself and never boots, wipes or reboots an Android emulator or device.

All docs · README