squad-kit 1.3.0 → 1.3.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/SECURITY.md +3 -1
- package/dist/cli.js +158 -144
- package/dist/console-ui/assets/{index-iFT5f2Y0.js → index-BhhlRfJM.js} +112 -112
- package/dist/console-ui/index.html +1 -1
- package/package.json +1 -1
package/SECURITY.md
CHANGED
|
@@ -64,7 +64,9 @@ Credit will be given in the release notes unless you prefer to remain anonymous.
|
|
|
64
64
|
GitHub and cloud sign-ins, the keys into a runtime's virtual machine, an `.npmrc` with a token), browser profiles and
|
|
65
65
|
squad-kit's own folder. A place it does not know about is not hidden.
|
|
66
66
|
- Reading the `.env` files in your project folder. On a Mac, all of them. On Linux, the ones it finds 3 folders down when
|
|
67
|
-
a command starts, outside folders such as `node_modules`.
|
|
67
|
+
a command starts, outside folders such as `node_modules`. One exception: the setup squad-kit runs in your own
|
|
68
|
+
checkout after a merge reads that checkout's `.env` files, as it does when you run it yourself (a database setup
|
|
69
|
+
needs them). It still reads no other `.env` file, key or sign-in.
|
|
68
70
|
- Writing outside its copy, the proof folder, the temp folder and the package caches. `~/.cache` and
|
|
69
71
|
`~/Library/Caches` stay read only: your own tools run programs from there. The copy cannot be moved, and git's own
|
|
70
72
|
folder cannot be changed or moved, so nothing written there can make squad-kit's own git start a program.
|