Добавить всякую документацию для красоты

CODE_OF_CONDUCT.md

@@ -0,0 +1,52 @@
+# Code of Conduct
+
+## 1. Purpose
+
+This Code of Conduct establishes the standards of behavior expected of all members of "PKS Java". It exists to promote integrity, respect, and accountability within our community.
+
+## 2. Scope
+
+This Code applies to all employees, contractors, volunteers, board members, and representatives of "PKS Java" in all work-related settings, including off-site events and digital communications.
+
+## 3. Core Principles
+
+All members are expected to:
+
+- **Act with integrity** — Be honest and transparent in all dealings.
+- **Treat others with respect** — Value diverse perspectives and communicate professionally.
+- **Take responsibility** — Own your actions and their consequences.
+- **Follow the law** — Comply with all applicable laws and regulations.
+- **Avoid conflicts of interest** — Disclose any personal interests that may conflict with your role.
+
+## 4. Expected Standards of Behavior
+
+- Maintain a professional and inclusive environment.
+- Protect confidential information and company property.
+- Use organizational resources responsibly and only for legitimate purposes.
+- Report suspected violations in good faith.
+- Cooperate fully with internal investigations.
+
+## 5. Prohibited Conduct
+
+The following will not be tolerated:
+
+- Harassment, discrimination, or bullying of any kind.
+- Violence, threats, or intimidation.
+- Fraud, theft, bribery, or falsification of records.
+- Unauthorized disclosure of confidential or proprietary information.
+- Retaliation against anyone who reports a concern in good faith.
+- Substance abuse that impairs work performance or safety.
+
+## 6. Consequences
+
+Violations of this Code may result in disciplinary action, up to and including termination of employment or association, and may be referred to law enforcement where appropriate.
+
+## 7. Acknowledgment
+
+All members are required to read, understand, and acknowledge this Code of Conduct upon joining and annually thereafter.
+
+---
+
+**Adopted:** 04.10.2026
+**Last Reviewed:** 04.10.2026
+**Approved By:** Vladimir Valekzhanin / vladcheck

CONTRIBUTING.md

@@ -0,0 +1,9 @@
+# Contributing
+
+## git pull
+
+Использование `git pull` без флага `--rebase` **крайне нежелательно**.
+
+```bash
+git pull --rebase
+```

LICENSE.md

@@ -0,0 +1,176 @@
+Academic Free License ("AFL") v. 3.0 This Academic Free License (the "License")
+applies to any original work of authorship (the "Original Work") whose owner (the
+"Licensor") has placed the following licensing notice adjacent to the copyright
+notice for the Original Work:
+
+Licensed under the Academic Free License version
+3.0
+
+   1) Grant of Copyright License. Licensor grants You a worldwide,
+royalty-free, non-exclusive, sublicensable license, for the duration of the
+copyright, to do the following:
+
+      a) to reproduce the Original Work in
+copies, either alone or as part of a collective work;
+
+      b) to translate,
+adapt, alter, transform, modify, or arrange the Original Work, thereby creating
+derivative works ("Derivative Works") based upon the Original Work;
+
+      c) to
+distribute or communicate copies of the Original Work and Derivative Works to the
+public, under any license of your choice that does not contradict the terms and
+conditions, including Licensor's reserved rights and remedies, in this Academic
+Free License;
+
+      d) to perform the Original Work publicly; and
+
+      e) to
+display the Original Work publicly.
+
+   2) Grant of Patent License. Licensor
+grants You a worldwide, royalty-free, non-exclusive, sublicensable license, under
+patent claims owned or controlled by the Licensor that are embodied in the
+Original Work as furnished by the Licensor, for the duration of the patents, to
+make, use, sell, offer for sale, have made, and import the Original Work and
+Derivative Works.
+
+   3) Grant of Source Code License. The term "Source Code"
+means the preferred form of the Original Work for making modifications to it and
+all available documentation describing how to modify the Original Work. Licensor
+agrees to provide a machine-readable copy of the Source Code of the Original Work
+along with each copy of the Original Work that Licensor distributes. Licensor
+reserves the right to satisfy this obligation by placing a machine-readable copy
+of the Source Code in an information repository reasonably calculated to permit
+inexpensive and convenient access by You for as long as Licensor continues to
+distribute the Original Work.
+
+   4) Exclusions From License Grant. Neither the
+names of Licensor, nor the names of any contributors to the Original Work, nor
+any of their trademarks or service marks, may be used to endorse or promote
+products derived from this Original Work without express prior permission of the
+Licensor. Except as expressly stated herein, nothing in this License grants any
+license to Licensor's trademarks, copyrights, patents, trade secrets or any other
+intellectual property. No patent license is granted to make, use, sell, offer for
+sale, have made, or import embodiments of any patent claims other than the
+licensed claims defined in Section 2. No license is granted to the trademarks of
+Licensor even if such marks are included in the Original Work. Nothing in this
+License shall be interpreted to prohibit Licensor from licensing under terms
+different from this License any Original Work that Licensor otherwise would have
+a right to license.
+
+   5) External Deployment. The term "External Deployment"
+means the use, distribution, or communication of the Original Work or Derivative
+Works in any way such that the Original Work or Derivative Works may be used by
+anyone other than You, whether those works are distributed or communicated to
+those persons or made available as an application intended for use over a
+network. As an express condition for the grants of license hereunder, You must
+treat any External Deployment by You of the Original Work or a Derivative Work as
+a distribution under section 1(c).
+
+   6) Attribution Rights. You must retain, in
+the Source Code of any Derivative Works that You create, all copyright, patent,
+or trademark notices from the Source Code of the Original Work, as well as any
+notices of licensing and any descriptive text identified therein as an
+"Attribution Notice." You must cause the Source Code for any Derivative Works
+that You create to carry a prominent Attribution Notice reasonably calculated to
+inform recipients that You have modified the Original Work.
+
+   7) Warranty of
+Provenance and Disclaimer of Warranty. Licensor warrants that the copyright in
+and to the Original Work and the patent rights granted herein by Licensor are
+owned by the Licensor or are sublicensed to You under the terms of this License
+with the permission of the contributor(s) of those copyrights and patent rights.
+Except as expressly stated in the immediately preceding sentence, the Original
+Work is provided under this License on an "AS IS" BASIS and WITHOUT WARRANTY,
+either express or implied, including, without limitation, the warranties of
+non-infringement, merchantability or fitness for a particular purpose. THE ENTIRE
+RISK AS TO THE QUALITY OF THE ORIGINAL WORK IS WITH YOU. This DISCLAIMER OF
+WARRANTY constitutes an essential part of this License. No license to the
+Original Work is granted by this License except under this disclaimer.
+
+   8)
+Limitation of Liability. Under no circumstances and under no legal theory,
+whether in tort (including negligence), contract, or otherwise, shall the
+Licensor be liable to anyone for any indirect, special, incidental, or
+consequential damages of any character arising as a result of this License or the
+use of the Original Work including, without limitation, damages for loss of
+goodwill, work stoppage, computer failure or malfunction, or any and all other
+commercial damages or losses. This limitation of liability shall not apply to the
+extent applicable law prohibits such limitation.
+
+   9) Acceptance and
+Termination. If, at any time, You expressly assented to this License, that assent
+indicates your clear and irrevocable acceptance of this License and all of its
+terms and conditions. If You distribute or communicate copies of the Original
+Work or a Derivative Work, You must make a reasonable effort under the
+circumstances to obtain the express assent of recipients to the terms of this
+License. This License conditions your rights to undertake the activities listed
+in Section 1, including your right to create Derivative Works based upon the
+Original Work, and doing so without honoring these terms and conditions is
+prohibited by copyright law and international treaty. Nothing in this License is
+intended to affect copyright exceptions and limitations (including "fair use" or
+"fair dealing"). This License shall terminate immediately and You may no longer
+exercise any of the rights granted to You by this License upon your failure to
+honor the conditions in Section 1(c).
+
+   10) Termination for Patent Action. This
+License shall terminate automatically and You may no longer exercise any of the
+rights granted to You by this License as of the date You commence an action,
+including a cross-claim or counterclaim, against Licensor or any licensee
+alleging that the Original Work infringes a patent. This termination provision
+shall not apply for an action alleging patent infringement by combinations of the
+Original Work with other software or hardware.
+
+   11) Jurisdiction, Venue and
+Governing Law. Any action or suit relating to this License may be brought only in
+the courts of a jurisdiction wherein the Licensor resides or in which Licensor
+conducts its primary business, and under the laws of that jurisdiction excluding
+its conflict-of-law provisions. The application of the United Nations Convention
+on Contracts for the International Sale of Goods is expressly excluded. Any use
+of the Original Work outside the scope of this License or after its termination
+shall be subject to the requirements and penalties of copyright or patent law in
+the appropriate jurisdiction. This section shall survive the termination of this
+License.
+
+   12) Attorneys' Fees. In any action to enforce the terms of this
+License or seeking damages relating thereto, the prevailing party shall be
+entitled to recover its costs and expenses, including, without limitation,
+reasonable attorneys' fees and costs incurred in connection with such action,
+including any appeal of such action. This section shall survive the termination
+of this License.
+
+   13) Miscellaneous. If any provision of this License is held
+to be unenforceable, such provision shall be reformed only to the extent
+necessary to make it enforceable.
+
+   14) Definition of "You" in This License.
+"You" throughout this License, whether in upper or lower case, means an
+individual or a legal entity exercising rights under, and complying with all of
+the terms of, this License. For legal entities, "You" includes any entity that
+controls, is controlled by, or is under common control with you. For purposes of
+this definition, "control" means (i) the power, direct or indirect, to cause the
+direction or management of such entity, whether by contract or otherwise, or (ii)
+ownership of fifty percent (50%) or more of the outstanding shares, or (iii)
+beneficial ownership of such entity.
+
+   15) Right to Use. You may use the
+Original Work in all ways not otherwise restricted or conditioned by this License
+or by law, and Licensor promises not to interfere with or be responsible for such
+uses by You.
+
+   16) Modification of This License. This License is Copyright ©
+2005 Vladimir Valekzhanin. Permission is granted to copy, distribute, or
+communicate this License without modification. Nothing in this License permits
+You to modify this License as applied to the Original Work or to Derivative
+Works. However, You may modify the text of this License and copy, distribute or
+communicate your modified version (the "Modified License") and apply it to other
+original works of authorship subject to the following conditions: (i) You may not
+indicate in any way that your Modified License is the "Academic Free License" or
+"AFL" and you may not use those names in the name of your Modified License; (ii)
+You must replace the notice specified in the first paragraph above with the
+notice "Licensed under <insert your license name here>" or with a notice of your
+own that is not confusingly similar to the notice in this License; and (iii) You
+may not claim that your original works are open source software unless your
+Modified License has been approved by Open Source Initiative (OSI) and You comply
+with its license review and certification process.

SECURITY.md

@@ -0,0 +1,113 @@
+# Security Policy
+
+## Supported Versions
+
+This project follows a rolling release model. Security fixes are applied to the latest released version only.
+
+| Version        | Supported          |
+| -------------- | ------------------ |
+| 1.0.x (latest) | Yes |
+| < 1.0          | No                |
+
+As the project matures, this table will be updated to reflect long-term support (LTS) branches if applicable.
+
+## Reporting a Vulnerability
+
+We take the security of **DesktopApplicationClientJava** seriously. If you believe you have found a security vulnerability, please help us address it responsibly.
+
+### How to Report
+
+**Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.**
+
+Instead, use one of the following private channels:
+
+1. **GitHub Private Vulnerability Reporting** (preferred)
+   Navigate to the repository's [Security tab](https://github.com/vladcheck/DesktopApplicationClientJava/security) and click **"Report a vulnerability"**.
+
+### What to Include
+
+To help us triage and resolve the issue quickly, please include:
+
+- A clear description of the vulnerability and its potential impact.
+- The affected component (e.g., module, class, or dependency).
+- Step-by-step reproduction instructions or a proof-of-concept (PoC).
+- The affected version(s) and environment (OS, JDK version, JavaFX version).
+- Any suggested mitigation or fix, if known.
+- Whether you wish to be credited in the advisory.
+
+### What to Expect
+
+| Stage                                 | Target Timeframe                 |
+| ------------------------------------- | -------------------------------- |
+| Acknowledgement of report             | within **3 business days**       |
+| Initial assessment / triage           | within **7 business days**       |
+| Status update                         | every **14 days** until resolved |
+| Fix or mitigation for critical issues | as soon as reasonably possible   |
+
+If the vulnerability is accepted, we will:
+
+- Work with you to understand and validate the issue.
+- Prepare and release a patched version.
+- Publish a security advisory crediting you (unless you prefer to remain anonymous).
+
+If the vulnerability is declined, we will explain our reasoning.
+
+## Scope
+
+### In Scope
+
+- Source code in this repository (Java/JavaFX application code).
+- Configuration files, build scripts (`pom.xml`), and CI/CD pipelines maintained in this repository.
+- Dependency vulnerabilities that are exploitable through this application.
+
+### Out of Scope
+
+- Vulnerabilities in third-party dependencies that are already publicly disclosed and have no exploitable path in this application (please report those upstream).
+- Issues requiring physical access to an unlocked device.
+- Social engineering attacks against contributors or users.
+- Denial-of-service via resource exhaustion on the local machine.
+- Findings from automated scanners submitted without a demonstrated impact.
+
+## Security Practices
+
+This project aims to follow these practices:
+
+- **Dependency hygiene** — Dependencies are declared with pinned versions in `pom.xml`. We monitor advisories (e.g., via GitHub Dependabot) and update where practical.
+- **Build reproducibility** — The Maven build uses fixed plugin and dependency versions, and the compiler targets Java 25.
+- **Static analysis** — Code formatting and analysis are enforced via Spotless (`google-java-format`) during the `verify` phase.
+- **Least privilege** — The application is a desktop client and does not require elevated privileges to run.
+- **Secrets management** — No credentials, tokens, or private keys are committed to the repository. Secrets must be supplied via environment variables or a secure secret store.
+
+## Handling of Sensitive Data
+
+If the application processes user data, tokens, or credentials, the following apply:
+
+- Sensitive values must not be logged.
+- Data at rest should be stored using OS-appropriate secure storage.
+- Network communication should use TLS.
+- Jackson is used for (de)serialization; deserialization of untrusted input is restricted to known-safe types where possible.
+
+## Dependency Vulnerability Disclosure
+
+If you discover a vulnerability in a dependency used by this project:
+
+1. Report it to the upstream maintainer first.
+2. Notify us if the issue is exploitable through this application so we can pin, patch, or mitigate.
+
+## Security Updates
+
+Security fixes will be released as patch versions. Users are encouraged to:
+
+- Watch the repository for releases.
+- Subscribe to GitHub security advisories for this project.
+- Rebuild from the latest tagged release.
+
+## Acknowledgements
+
+We thank the security researchers and community members who responsibly disclose issues and help keep this project and its users safe.
+
+---
+
+**Adopted:** 04.10.2026
+**Last Reviewed:** 04.10.2026
+**Approved By:** Vladimir Valekzhanin / vladcheck