From 51b76e12b6c23ecfee2e207d7ccd6c4302acd25c Mon Sep 17 00:00:00 2001 From: SandObserver <260779319+SandObserver@users.noreply.github.com> Date: Sun, 9 Aug 2026 16:06:09 -0400 Subject: [PATCH] Docs: cut repeated claims from the README and the security overview The README described the launcher grid twice, in the intro and again under Why Stackyard, and stated the no-dependency claim in both places; the second copy of each said less than the first. The security overview opened with two paragraphs that both told the reader not to expose Stackyard to the internet. Also repairs a sentence in the release-verification section that was left broken mid-clause, and separates the scan from the SBOM. --- README.md | 5 ++--- docs/security.md | 12 +++++------- 2 files changed, 7 insertions(+), 10 deletions(-) diff --git a/README.md b/README.md index bf33b243..56b69f18 100644 --- a/README.md +++ b/README.md @@ -16,7 +16,7 @@ Note: The first demo visit may take up to a minute due to Render's free-tier cold start. Most dashboards are a wall of numbers and charts. Stackyard is the opposite: a calm, launcher-style grid of app tiles, folders, and a small number of -*genuinely useful* widgets, running in a single container with no external services or dependencies. Built to be glanced at a hundred times a day without feeling cluttered. +*genuinely useful* widgets, running in a single container. Built to be glanced at a hundred times a day without feeling cluttered. ## Contents @@ -40,8 +40,7 @@ Most dashboards are a wall of numbers and charts. Stackyard is the opposite: a c - **Configured by clicking, not by editing files.** Everything is set up in the web UI, with config import and export. - **No dependencies.** Review it once and stop worrying about the supply chain. -Launcher-style grid of app links, folders, and widgets, with a mobile layout. -Available in English, Persian, Chinese, Spanish, German, and French. +Has a mobile layout, and is available in English, Persian, Chinese, Spanish, German, and French. ## Getting started diff --git a/docs/security.md b/docs/security.md index ba2279b5..62bedfa0 100644 --- a/docs/security.md +++ b/docs/security.md @@ -2,9 +2,7 @@ ## Network exposure -Stackyard does not terminate TLS and serves traffic over plain HTTP only. While login attempts are rate-limited, the application is **not** designed or hardened for direct exposure to the public internet. Authentication exists primarily to simplify management of multiple local dashboards and should not be relied on as an internet-facing security boundary. - -Deploy Stackyard only on a trusted network, or behind a reverse proxy that terminates TLS and provides its own authentication and access controls. Do **not** expose it directly to the internet or make it accessible via port forwarding. +Stackyard does not terminate TLS and serves traffic over plain HTTP only. Login attempts are rate-limited, but the application is **not** designed or hardened for direct exposure to the public internet: authentication exists to simplify management of multiple local dashboards, and is not an internet-facing security boundary. Deploy it on a trusted network, or behind a reverse proxy that terminates TLS and provides its own authentication and access controls. ## HTTPS and the session cookie @@ -187,10 +185,10 @@ which proves only that something signed the image. Each release build also scans the image with Trivy before publishing it and fails on a HIGH or CRITICAL finding that has a fix available, so a flagged image never reaches a registry. The scan covers `linux/amd64`; `linux/arm64` is built -by emulation and cannot be scanned before it is pushed. The build also produces -an SPDX SBOM listing -what is inside it. The SBOM is attached to the build as an artifact, downloadable -from the run's summary page on GitHub. +by emulation and cannot be scanned before it is pushed. + +The build also produces an SPDX SBOM listing what is inside the image, attached +to the run as an artifact and downloadable from its summary page on GitHub. Images are published to `ghcr.io/sandobserver/stackyard`. A Docker Hub mirror is published alongside it when the project has credentials configured; ghcr.io is