diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..309a119 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,52 @@ +# Code of Conduct + +## 1. Purpose + +This Code of Conduct establishes the standards of behavior expected of all members of "PKS Java". It exists to promote integrity, respect, and accountability within our community. + +## 2. Scope + +This Code applies to all employees, contractors, volunteers, board members, and representatives of "PKS Java" in all work-related settings, including off-site events and digital communications. + +## 3. Core Principles + +All members are expected to: + +- **Act with integrity** — Be honest and transparent in all dealings. +- **Treat others with respect** — Value diverse perspectives and communicate professionally. +- **Take responsibility** — Own your actions and their consequences. +- **Follow the law** — Comply with all applicable laws and regulations. +- **Avoid conflicts of interest** — Disclose any personal interests that may conflict with your role. + +## 4. Expected Standards of Behavior + +- Maintain a professional and inclusive environment. +- Protect confidential information and company property. +- Use organizational resources responsibly and only for legitimate purposes. +- Report suspected violations in good faith. +- Cooperate fully with internal investigations. + +## 5. Prohibited Conduct + +The following will not be tolerated: + +- Harassment, discrimination, or bullying of any kind. +- Violence, threats, or intimidation. +- Fraud, theft, bribery, or falsification of records. +- Unauthorized disclosure of confidential or proprietary information. +- Retaliation against anyone who reports a concern in good faith. +- Substance abuse that impairs work performance or safety. + +## 6. Consequences + +Violations of this Code may result in disciplinary action, up to and including termination of employment or association, and may be referred to law enforcement where appropriate. + +## 7. Acknowledgment + +All members are required to read, understand, and acknowledge this Code of Conduct upon joining and annually thereafter. + +--- + +**Adopted:** 04.10.2026 +**Last Reviewed:** 04.10.2026 +**Approved By:** Vladimir Valekzhanin / vladcheck \ No newline at end of file diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..207caad --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,9 @@ +# Contributing + +## git pull + +Использование `git pull` без флага `--rebase` **крайне нежелательно**. + +```bash +git pull --rebase +``` \ No newline at end of file diff --git a/LICENSE.md b/LICENSE.md new file mode 100644 index 0000000..4b65235 --- /dev/null +++ b/LICENSE.md @@ -0,0 +1,176 @@ +Academic Free License ("AFL") v. 3.0 This Academic Free License (the "License") +applies to any original work of authorship (the "Original Work") whose owner (the +"Licensor") has placed the following licensing notice adjacent to the copyright +notice for the Original Work: + +Licensed under the Academic Free License version +3.0 + + 1) Grant of Copyright License. Licensor grants You a worldwide, +royalty-free, non-exclusive, sublicensable license, for the duration of the +copyright, to do the following: + + a) to reproduce the Original Work in +copies, either alone or as part of a collective work; + + b) to translate, +adapt, alter, transform, modify, or arrange the Original Work, thereby creating +derivative works ("Derivative Works") based upon the Original Work; + + c) to +distribute or communicate copies of the Original Work and Derivative Works to the +public, under any license of your choice that does not contradict the terms and +conditions, including Licensor's reserved rights and remedies, in this Academic +Free License; + + d) to perform the Original Work publicly; and + + e) to +display the Original Work publicly. + + 2) Grant of Patent License. Licensor +grants You a worldwide, royalty-free, non-exclusive, sublicensable license, under +patent claims owned or controlled by the Licensor that are embodied in the +Original Work as furnished by the Licensor, for the duration of the patents, to +make, use, sell, offer for sale, have made, and import the Original Work and +Derivative Works. + + 3) Grant of Source Code License. The term "Source Code" +means the preferred form of the Original Work for making modifications to it and +all available documentation describing how to modify the Original Work. Licensor +agrees to provide a machine-readable copy of the Source Code of the Original Work +along with each copy of the Original Work that Licensor distributes. Licensor +reserves the right to satisfy this obligation by placing a machine-readable copy +of the Source Code in an information repository reasonably calculated to permit +inexpensive and convenient access by You for as long as Licensor continues to +distribute the Original Work. + + 4) Exclusions From License Grant. Neither the +names of Licensor, nor the names of any contributors to the Original Work, nor +any of their trademarks or service marks, may be used to endorse or promote +products derived from this Original Work without express prior permission of the +Licensor. Except as expressly stated herein, nothing in this License grants any +license to Licensor's trademarks, copyrights, patents, trade secrets or any other +intellectual property. No patent license is granted to make, use, sell, offer for +sale, have made, or import embodiments of any patent claims other than the +licensed claims defined in Section 2. No license is granted to the trademarks of +Licensor even if such marks are included in the Original Work. Nothing in this +License shall be interpreted to prohibit Licensor from licensing under terms +different from this License any Original Work that Licensor otherwise would have +a right to license. + + 5) External Deployment. The term "External Deployment" +means the use, distribution, or communication of the Original Work or Derivative +Works in any way such that the Original Work or Derivative Works may be used by +anyone other than You, whether those works are distributed or communicated to +those persons or made available as an application intended for use over a +network. As an express condition for the grants of license hereunder, You must +treat any External Deployment by You of the Original Work or a Derivative Work as +a distribution under section 1(c). + + 6) Attribution Rights. You must retain, in +the Source Code of any Derivative Works that You create, all copyright, patent, +or trademark notices from the Source Code of the Original Work, as well as any +notices of licensing and any descriptive text identified therein as an +"Attribution Notice." You must cause the Source Code for any Derivative Works +that You create to carry a prominent Attribution Notice reasonably calculated to +inform recipients that You have modified the Original Work. + + 7) Warranty of +Provenance and Disclaimer of Warranty. Licensor warrants that the copyright in +and to the Original Work and the patent rights granted herein by Licensor are +owned by the Licensor or are sublicensed to You under the terms of this License +with the permission of the contributor(s) of those copyrights and patent rights. +Except as expressly stated in the immediately preceding sentence, the Original +Work is provided under this License on an "AS IS" BASIS and WITHOUT WARRANTY, +either express or implied, including, without limitation, the warranties of +non-infringement, merchantability or fitness for a particular purpose. THE ENTIRE +RISK AS TO THE QUALITY OF THE ORIGINAL WORK IS WITH YOU. This DISCLAIMER OF +WARRANTY constitutes an essential part of this License. No license to the +Original Work is granted by this License except under this disclaimer. + + 8) +Limitation of Liability. Under no circumstances and under no legal theory, +whether in tort (including negligence), contract, or otherwise, shall the +Licensor be liable to anyone for any indirect, special, incidental, or +consequential damages of any character arising as a result of this License or the +use of the Original Work including, without limitation, damages for loss of +goodwill, work stoppage, computer failure or malfunction, or any and all other +commercial damages or losses. This limitation of liability shall not apply to the +extent applicable law prohibits such limitation. + + 9) Acceptance and +Termination. If, at any time, You expressly assented to this License, that assent +indicates your clear and irrevocable acceptance of this License and all of its +terms and conditions. If You distribute or communicate copies of the Original +Work or a Derivative Work, You must make a reasonable effort under the +circumstances to obtain the express assent of recipients to the terms of this +License. This License conditions your rights to undertake the activities listed +in Section 1, including your right to create Derivative Works based upon the +Original Work, and doing so without honoring these terms and conditions is +prohibited by copyright law and international treaty. Nothing in this License is +intended to affect copyright exceptions and limitations (including "fair use" or +"fair dealing"). This License shall terminate immediately and You may no longer +exercise any of the rights granted to You by this License upon your failure to +honor the conditions in Section 1(c). + + 10) Termination for Patent Action. This +License shall terminate automatically and You may no longer exercise any of the +rights granted to You by this License as of the date You commence an action, +including a cross-claim or counterclaim, against Licensor or any licensee +alleging that the Original Work infringes a patent. This termination provision +shall not apply for an action alleging patent infringement by combinations of the +Original Work with other software or hardware. + + 11) Jurisdiction, Venue and +Governing Law. Any action or suit relating to this License may be brought only in +the courts of a jurisdiction wherein the Licensor resides or in which Licensor +conducts its primary business, and under the laws of that jurisdiction excluding +its conflict-of-law provisions. The application of the United Nations Convention +on Contracts for the International Sale of Goods is expressly excluded. Any use +of the Original Work outside the scope of this License or after its termination +shall be subject to the requirements and penalties of copyright or patent law in +the appropriate jurisdiction. This section shall survive the termination of this +License. + + 12) Attorneys' Fees. In any action to enforce the terms of this +License or seeking damages relating thereto, the prevailing party shall be +entitled to recover its costs and expenses, including, without limitation, +reasonable attorneys' fees and costs incurred in connection with such action, +including any appeal of such action. This section shall survive the termination +of this License. + + 13) Miscellaneous. If any provision of this License is held +to be unenforceable, such provision shall be reformed only to the extent +necessary to make it enforceable. + + 14) Definition of "You" in This License. +"You" throughout this License, whether in upper or lower case, means an +individual or a legal entity exercising rights under, and complying with all of +the terms of, this License. For legal entities, "You" includes any entity that +controls, is controlled by, or is under common control with you. For purposes of +this definition, "control" means (i) the power, direct or indirect, to cause the +direction or management of such entity, whether by contract or otherwise, or (ii) +ownership of fifty percent (50%) or more of the outstanding shares, or (iii) +beneficial ownership of such entity. + + 15) Right to Use. You may use the +Original Work in all ways not otherwise restricted or conditioned by this License +or by law, and Licensor promises not to interfere with or be responsible for such +uses by You. + + 16) Modification of This License. This License is Copyright © +2005 Vladimir Valekzhanin. Permission is granted to copy, distribute, or +communicate this License without modification. Nothing in this License permits +You to modify this License as applied to the Original Work or to Derivative +Works. However, You may modify the text of this License and copy, distribute or +communicate your modified version (the "Modified License") and apply it to other +original works of authorship subject to the following conditions: (i) You may not +indicate in any way that your Modified License is the "Academic Free License" or +"AFL" and you may not use those names in the name of your Modified License; (ii) +You must replace the notice specified in the first paragraph above with the +notice "Licensed under " or with a notice of your +own that is not confusingly similar to the notice in this License; and (iii) You +may not claim that your original works are open source software unless your +Modified License has been approved by Open Source Initiative (OSI) and You comply +with its license review and certification process. \ No newline at end of file diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..cb81187 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,113 @@ +# Security Policy + +## Supported Versions + +This project follows a rolling release model. Security fixes are applied to the latest released version only. + +| Version | Supported | +| -------------- | ------------------ | +| 1.0.x (latest) | Yes | +| < 1.0 | No | + +As the project matures, this table will be updated to reflect long-term support (LTS) branches if applicable. + +## Reporting a Vulnerability + +We take the security of **DesktopApplicationClientJava** seriously. If you believe you have found a security vulnerability, please help us address it responsibly. + +### How to Report + +**Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.** + +Instead, use one of the following private channels: + +1. **GitHub Private Vulnerability Reporting** (preferred) + Navigate to the repository's [Security tab](https://github.com/vladcheck/DesktopApplicationClientJava/security) and click **"Report a vulnerability"**. + +### What to Include + +To help us triage and resolve the issue quickly, please include: + +- A clear description of the vulnerability and its potential impact. +- The affected component (e.g., module, class, or dependency). +- Step-by-step reproduction instructions or a proof-of-concept (PoC). +- The affected version(s) and environment (OS, JDK version, JavaFX version). +- Any suggested mitigation or fix, if known. +- Whether you wish to be credited in the advisory. + +### What to Expect + +| Stage | Target Timeframe | +| ------------------------------------- | -------------------------------- | +| Acknowledgement of report | within **3 business days** | +| Initial assessment / triage | within **7 business days** | +| Status update | every **14 days** until resolved | +| Fix or mitigation for critical issues | as soon as reasonably possible | + +If the vulnerability is accepted, we will: + +- Work with you to understand and validate the issue. +- Prepare and release a patched version. +- Publish a security advisory crediting you (unless you prefer to remain anonymous). + +If the vulnerability is declined, we will explain our reasoning. + +## Scope + +### In Scope + +- Source code in this repository (Java/JavaFX application code). +- Configuration files, build scripts (`pom.xml`), and CI/CD pipelines maintained in this repository. +- Dependency vulnerabilities that are exploitable through this application. + +### Out of Scope + +- Vulnerabilities in third-party dependencies that are already publicly disclosed and have no exploitable path in this application (please report those upstream). +- Issues requiring physical access to an unlocked device. +- Social engineering attacks against contributors or users. +- Denial-of-service via resource exhaustion on the local machine. +- Findings from automated scanners submitted without a demonstrated impact. + +## Security Practices + +This project aims to follow these practices: + +- **Dependency hygiene** — Dependencies are declared with pinned versions in `pom.xml`. We monitor advisories (e.g., via GitHub Dependabot) and update where practical. +- **Build reproducibility** — The Maven build uses fixed plugin and dependency versions, and the compiler targets Java 25. +- **Static analysis** — Code formatting and analysis are enforced via Spotless (`google-java-format`) during the `verify` phase. +- **Least privilege** — The application is a desktop client and does not require elevated privileges to run. +- **Secrets management** — No credentials, tokens, or private keys are committed to the repository. Secrets must be supplied via environment variables or a secure secret store. + +## Handling of Sensitive Data + +If the application processes user data, tokens, or credentials, the following apply: + +- Sensitive values must not be logged. +- Data at rest should be stored using OS-appropriate secure storage. +- Network communication should use TLS. +- Jackson is used for (de)serialization; deserialization of untrusted input is restricted to known-safe types where possible. + +## Dependency Vulnerability Disclosure + +If you discover a vulnerability in a dependency used by this project: + +1. Report it to the upstream maintainer first. +2. Notify us if the issue is exploitable through this application so we can pin, patch, or mitigate. + +## Security Updates + +Security fixes will be released as patch versions. Users are encouraged to: + +- Watch the repository for releases. +- Subscribe to GitHub security advisories for this project. +- Rebuild from the latest tagged release. + +## Acknowledgements + +We thank the security researchers and community members who responsibly disclose issues and help keep this project and its users safe. + +--- + +**Adopted:** 04.10.2026 +**Last Reviewed:** 04.10.2026 +**Approved By:** Vladimir Valekzhanin / vladcheck \ No newline at end of file