mirror of https://github.com/TheBushidoCollective/han.git synced 2026-09-14 20:16:44 +08:00

Files

T

jwaldrip 0d02eaf58a refactor(han): remove update command and update docs to use npx

Since hooks now use npx automatically, global installation is no longer
required. This removes the update command and auto-update functionality
(npx always uses the latest version), and updates all documentation to
use `npx @thebushidocollective/han` instead of `han`.

Changes:
- Remove update.ts command and auto-update logic from main.ts
- Remove update-related tests
- Update CONTRIBUTING.md to use npx for hook commands
- Update plugin READMEs (buki-biome, buki-rspec) to use npx
- Update create-buki.md template to use npx
- Update han CLI README.md to use npx as primary installation
- Update SECURITY.md to recommend npx for latest version
- Fix unused @ts-expect-error in hook-cache.ts

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

2025-12-01 13:15:43 -07:00

2.8 KiB

Raw Permalink Blame History

Security Policy

Supported Versions

We provide security updates for the following versions:

Version	Supported
Latest	✅
< 1.0	❌

Reporting a Vulnerability

We take security seriously and appreciate your help in responsibly disclosing vulnerabilities.

How to Report

Do NOT report security vulnerabilities through public GitHub issues.

Instead, please report them by:

Email: Send details to the project maintainers
Private Security Advisory: Use GitHub's private vulnerability reporting

What to Include

Please provide:

Type of vulnerability (e.g., command injection, path traversal)
Full path to the affected source file(s)
Step-by-step instructions to reproduce
Proof-of-concept or exploit code (if possible)
Impact assessment

Response Timeline

Initial Response: Within 48 hours
Status Update: Within 7 days
Resolution Target: Within 30 days (depending on complexity)

What to Expect

Acknowledgment: We'll confirm receipt of your report
Validation: We'll investigate and validate the issue
Fix Development: We'll work on a fix privately
Coordinated Disclosure: We'll coordinate release timing with you
Credit: We'll credit you in the release notes (unless you prefer anonymity)

Security Best Practices

For Plugin Authors

When creating plugins:

Never execute untrusted input directly
Validate all file paths and user inputs
Use --fail-fast to stop on first error
Avoid storing sensitive data in plugin files
Test hooks in isolated environments

For Users

When using han and plugins:

Only install plugins from trusted sources
Review hook commands before installation
Use npx to always get the latest version
Use han plugin list to audit installed plugins
Report suspicious plugins to maintainers

Security Features

Hook Execution

Hooks run in the user's shell context
Commands are executed as-is (no shell injection protection by default)
Use --cache to avoid re-running expensive validations

Plugin Installation

Plugins are fetched from the official marketplace
Plugin metadata is validated during installation
MCP servers run with user permissions

Known Limitations

Hooks execute arbitrary commands defined in plugin configurations
Plugin authors should be trusted before installation
MCP servers may have access to external services

Acknowledgments

We thank all security researchers who have helped make han more secure.

"In matters of truth and justice, there is no difference between large and small problems." - Shissai Chozan

2.8 KiB Raw Permalink Blame History