seo 0.0.15 → 0.1.0

package/SECURITY.md

@@ -0,0 +1,55 @@
+# Security
+
+## Report a vulnerability
+
+Do not open a public issue for a suspected vulnerability.
+
+Use GitHub's private vulnerability reporting flow:
+
+```txt
+https://github.com/iannuttall/seo/security/advisories/new
+```
+
+Include the affected command, package, or workflow, clear reproduction steps,
+and the practical impact. Remove Google tokens, API keys, account identifiers,
+analytics data, private URLs, and client data from every example.
+
+Use [GitHub Issues](https://github.com/iannuttall/seo/issues) for ordinary
+questions and non-sensitive bugs.
+
+## Local data and credentials
+
+`seo` is local-first. Project profiles, Google OAuth metadata, crawl reports,
+and caches stay on the machine running the command. Access and refresh tokens
+use the operating-system keychain when enabled; fallback token files and local
+credential files use private file permissions.
+
+Desktop OAuth client credentials are not confidential secrets. User tokens,
+provider API keys, and analytics data are confidential and must never be
+committed, pasted into issues, or included in fixtures.
+
+Use `seo privacy` to inspect local storage and `seo reset --yes` to remove it.
+Google grants can also be revoked at
+<https://myaccount.google.com/connections>.
+
+## Maintainer checks
+
+Before a public release or a change to auth, storage, crawling, or provider
+boundaries, run:
+
+```sh
+pnpm build
+pnpm typecheck
+pnpm test
+pnpm lint
+pnpm security:check
+pnpm pack --dry-run
+```
+
+The shared desktop OAuth client values are release build inputs. Store them as
+GitHub Actions secrets so they are injected only into the release build.
+Checked-in generated OAuth files must contain placeholders only.
+
+`pnpm security:check` runs the dependency audit and gitleaks. On macOS the
+helper installs gitleaks with Homebrew when it is missing. Other platforms must
+install gitleaks first.

package/TERMS.md

@@ -0,0 +1,94 @@
+# Terms of use
+
+Last updated: 10 July 2026
+
+These terms cover the official `seo` command-line tool, library, MCP server,
+documentation, and seoskills.dev website.
+
+## Open source licence
+
+The software is licensed under the [Apache License
+2.0](https://github.com/iannuttall/seo/blob/main/LICENSE). That licence controls
+your right to use, copy, modify, and distribute the code. Third-party packages
+keep their own licences.
+
+These terms do not take away rights granted by an applicable open source
+licence. They cover use of the official website, documentation, name, Google
+integration, and distributed project services that sit outside the source-code
+licence.
+
+## Use the tool responsibly
+
+You are responsible for the commands you run and the sites, accounts, and data
+you use with them. Only crawl, inspect, or analyse a site when you are allowed
+to do so. Follow applicable laws, access controls, robots policies, provider
+terms, and reasonable rate limits.
+
+Do not use the project to gain unauthorised access, disrupt a service, evade a
+technical restriction, expose another person's data, or carry out unlawful
+activity.
+
+## Google and other third-party services
+
+Google Search Console and Google Analytics access is optional and read-only.
+Your use of Google APIs is also subject to Google's terms and policies. Google
+can change API behaviour, quotas, scopes, or availability without notice to
+this project.
+
+The software can request public websites, run browser tooling, and use package
+registries or operating system services. Those products are controlled by
+their respective operators. The project is not responsible for their content,
+availability, security, or data practices.
+
+## Reports are evidence, not a guarantee
+
+SEO reports can be incomplete because websites change, providers retain or cap
+data, crawls stop, and search systems do not publish every ranking signal. The
+software is designed to show those limits, but bugs and incorrect findings are
+still possible.
+
+Reports are general technical information. They do not promise rankings,
+traffic, revenue, indexing, rich results, AI citations, or any other outcome.
+Check important findings against the live site and the relevant provider before
+making a consequential change.
+
+## Your local data
+
+You are responsible for protecting local tokens, configuration, caches,
+reports, exports, backups, and environment variables. Keep secrets out of
+public issues, logs, screenshots, repositories, and shared report files.
+
+The [privacy policy](https://seoskills.dev/privacy) explains what the software
+stores and how to remove it.
+
+## Availability and changes
+
+The project may change commands, reports, integrations, or documentation in a
+future release. A feature can be fixed, replaced, or removed when needed for
+security, correctness, provider policy, or maintainability.
+
+There is no promise that the website, package registry, Google integration, or
+project support will always be available.
+
+## Warranty and liability
+
+The software and website are provided without warranties or guarantees. The
+Apache License 2.0 contains the warranty and liability terms for the licensed
+software.
+
+To the fullest extent allowed by applicable law, the project maintainer is not
+liable for indirect, incidental, special, consequential, or business losses
+arising from use of the software, website, reports, or third-party services.
+Nothing in these terms excludes liability that cannot legally be excluded.
+
+## Changes to these terms
+
+The date at the top will be updated when these terms change. Earlier versions
+remain available in the public Git history. Continued use after a change means
+the new terms apply to later use.
+
+## Questions about these terms
+
+Open an issue in the [public GitHub repository](https://github.com/iannuttall/seo/issues).
+Do not include OAuth tokens, private reports, personal data, or other secrets in
+a public issue.

package/TRADEMARKS.md

@@ -0,0 +1,27 @@
+# Trademark and brand policy
+
+The source code is available under Apache-2.0. That license does not grant a
+right to present another product or service as the official `seo` project.
+
+This policy covers the SEO Skills name, seoskills.dev, project artwork, and the
+`seo` name when it refers specifically to this package and project. It does not
+claim ownership of the generic term "SEO."
+
+## Uses that are fine
+
+- Truthfully saying that software uses, supports, or is based on `seo`.
+- Linking to the official repository or seoskills.dev.
+- Keeping required attribution and notices in copies or forks.
+- Describing a fork as an unofficial fork, provided the distinction is clear.
+
+## Ask first
+
+Open a [GitHub Issue](https://github.com/iannuttall/seo/issues) before using the
+project name or artwork as the main identity of a product, company, hosted
+service, domain, package, event, or merchandise.
+
+Do not imply endorsement, partnership, or official status. Forks and hosted
+versions must use a distinct name and visual identity, and must not create
+confusion with the npm package, repository, or seoskills.dev.
+
+Nominative and other uses allowed by applicable law remain allowed.