Skip to content

v0.6.3: SECURITY.md catch-up

Choose a tag to compare

View all tags
@HiroAlleyCat HiroAlleyCat released this 03 Jun 16:01
· 32 commits to main since this release
v0.6.3
8db06d6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Summary

Pure documentation release. Brings api-tester to the same documented security posture as the rest of the WDGoWars feeder family (Muninn, Heimdall, wigle-to-wdgwars all carry a SECURITY.md). No behavior changes; the only code touched is the __version__ bump from 0.6.2 to 0.6.3.

What changed

Added

  • SECURITY.md: documents the probe's outbound footprint, key handling, --exec-on-change threat model, and alert payload shapes (Telegram + webhook). Lifted from Heimdall's template and adapted for the probe-tool surface — api-tester reads keys but never saves them, and has alert paths the uploaders don't.

Documented (not ported)

The 2026-06-03 family audit checked whether the rest of the 5-piece safety net (scripts/check_readme_examples.py, pages.yml, --setup/--update/--schedule) belonged here too. CHANGELOG records the rationale for each "no":

  • README linter is irrelevant for a single-file stdlib-only tool (no PEP-668 venv-form footgun to catch).
  • pages.yml publishes the web/ Pyodide frontend Muninn and Heimdall carry; api-tester has no browser surface.
  • --setup/--update/--schedule from the uploader family don't fit the probe shape — api-tester reads from the shared family config path and uses --watch for continuous monitoring.

Test plan

  • bash scripts/smoke.sh — passes (parse + import + version + help + offline tests + mock-server roundtrip)
  • --version reports 0.6.3
  • No code changes beyond version bump, so existing test surface still covers behavior
Assets 2
Loading