diff --git a/README.md b/README.md index bf33b243..56b69f18 100644 --- a/README.md +++ b/README.md @@ -16,7 +16,7 @@ Note: The first demo visit may take up to a minute due to Render's free-tier cold start. Most dashboards are a wall of numbers and charts. Stackyard is the opposite: a calm, launcher-style grid of app tiles, folders, and a small number of -*genuinely useful* widgets, running in a single container with no external services or dependencies. Built to be glanced at a hundred times a day without feeling cluttered. +*genuinely useful* widgets, running in a single container. Built to be glanced at a hundred times a day without feeling cluttered. ## Contents @@ -40,8 +40,7 @@ Most dashboards are a wall of numbers and charts. Stackyard is the opposite: a c - **Configured by clicking, not by editing files.** Everything is set up in the web UI, with config import and export. - **No dependencies.** Review it once and stop worrying about the supply chain. -Launcher-style grid of app links, folders, and widgets, with a mobile layout. -Available in English, Persian, Chinese, Spanish, German, and French. +Has a mobile layout, and is available in English, Persian, Chinese, Spanish, German, and French. ## Getting started diff --git a/docs/security.md b/docs/security.md index ba2279b5..62bedfa0 100644 --- a/docs/security.md +++ b/docs/security.md @@ -2,9 +2,7 @@ ## Network exposure -Stackyard does not terminate TLS and serves traffic over plain HTTP only. While login attempts are rate-limited, the application is **not** designed or hardened for direct exposure to the public internet. Authentication exists primarily to simplify management of multiple local dashboards and should not be relied on as an internet-facing security boundary. - -Deploy Stackyard only on a trusted network, or behind a reverse proxy that terminates TLS and provides its own authentication and access controls. Do **not** expose it directly to the internet or make it accessible via port forwarding. +Stackyard does not terminate TLS and serves traffic over plain HTTP only. Login attempts are rate-limited, but the application is **not** designed or hardened for direct exposure to the public internet: authentication exists to simplify management of multiple local dashboards, and is not an internet-facing security boundary. Deploy it on a trusted network, or behind a reverse proxy that terminates TLS and provides its own authentication and access controls. ## HTTPS and the session cookie @@ -187,10 +185,10 @@ which proves only that something signed the image. Each release build also scans the image with Trivy before publishing it and fails on a HIGH or CRITICAL finding that has a fix available, so a flagged image never reaches a registry. The scan covers `linux/amd64`; `linux/arm64` is built -by emulation and cannot be scanned before it is pushed. The build also produces -an SPDX SBOM listing -what is inside it. The SBOM is attached to the build as an artifact, downloadable -from the run's summary page on GitHub. +by emulation and cannot be scanned before it is pushed. + +The build also produces an SPDX SBOM listing what is inside the image, attached +to the run as an artifact and downloadable from its summary page on GitHub. Images are published to `ghcr.io/sandobserver/stackyard`. A Docker Hub mirror is published alongside it when the project has credentials configured; ghcr.io is