CRT
710c3a53d0
README is a short front page (about 120 lines) with one real visual per section; every former section moved unchanged into docs/*.md with a docs/README.md index (journey, rejections, getting-started, commands, growth, studios, store-art, listing-languages, api, skills, mcp, safety, faq, project). The site tells the same story on one page: the teaser in the hero, real CLI output as text, the desktop app as a section with light/dark captures of eight screens and the per-system downloads (desktop/latest.json); /desktop/ redirects to /#download. New capture tools: tools/site-desktop-shots.ts (fixture-mode desktop frames) and tools/site-term-shots.ts (real CLI output as text and WebP). tests/docs-links.test.ts checks README, docs and site links resolve.
25 lines
2 KiB
Markdown
25 lines
2 KiB
Markdown
# Safety model
|
|
|
|
- **Credentials** live in env vars or the gitignored `.storebound/credentials.json`, never in the config or the repo.
|
|
storebound only talks to the official store APIs (plus Google Fonts, your own Play reports bucket and your own URLs);
|
|
see [SECURITY.md](../SECURITY.md).
|
|
- **Dry run everywhere.** Every write command takes `--dry`; every MCP write tool has `dry_run`, **default true**.
|
|
Raw API writes (`storebound api`) are dry unless `--yes` is given in an interactive terminal; owner-only operations
|
|
also need the operation id typed, and MCP only gets the read-only `api_get`.
|
|
- **Nothing public or irreversible through an agent.** Submitting for review (App Review and Beta App Review),
|
|
releasing a version, production releases, resuming or completing a rollout or phased release, canceling a
|
|
submission, deleting, inviting or removing testers, sending review replies, applying prices and starting or
|
|
stopping a product page test and creating custom offer codes are not MCP tools. Subscription syncs through MCP only
|
|
create what is new; price changes of live subscriptions wait for a terminal run. They stay terminal commands that ask for confirmation, and the skills tell every agent to ask the owner
|
|
first ([docs/agents-core.md](agents-core.md)).
|
|
- **Personal data stays local.** Tester lists, the App Review demo account, reply drafts, health reports and analytics
|
|
snapshots live in the gitignored `.storebound/` (the demo account is masked in every log line); tester emails are masked in every log line, and the config refuses a tester CSV path
|
|
outside `.storebound/`.
|
|
- **Idempotent writes.** Re-running a command converges (MD5 checks for screenshots and previews, one Play edit per
|
|
language), so a failed upload is fixed by running it again.
|
|
- **Simulators and emulators**: storebound shuts down only a simulator it booted itself and never boots, wipes or
|
|
reboots an Android emulator or device.
|
|
|
|
---
|
|
|
|
[All docs](README.md) · [README](../README.md)
|