Skip to content

Commit 99c1966

Browse files
komalharshitakomalharshita
committed
add docs
1 parent 56d5990 commit 99c1966

3 files changed

Lines changed: 561 additions & 0 deletions

File tree

‎PULL_REQUEST_TEMPLATE.md‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
<!--
2+
Pull Request Template — DevPath
3+
--------------------------------
4+
Delete sections that do not apply.
5+
Every section marked [required] must be completed before review begins.
6+
PRs with empty required sections will be returned without review.
7+
-->
8+
9+
## Summary [required]
10+
11+
<!-- One paragraph explaining what this PR does and why. -->
12+
<!-- Do not just repeat the commit message or the issue title. -->
13+
14+
15+
16+
## Related Issue [required]
17+
18+
<!-- Every PR must link to an open issue. -->
19+
<!-- If no issue exists, open one before submitting this PR. -->
20+
21+
Closes #
22+
23+
## Type of Change [required]
24+
25+
<!-- Check all that apply. -->
26+
27+
- [ ] Bug fix — resolves a broken behaviour
28+
- [ ] Feature — adds new functionality
29+
- [ ] Data — adds new projects to `data/projects.json`
30+
- [ ] Documentation — updates docs, README, or code comments only
31+
- [ ] Style — CSS or visual changes only, no logic change
32+
- [ ] Refactor — restructures code without changing behaviour
33+
- [ ] Test — adds or updates tests
34+
35+
## What Was Changed [required]
36+
37+
<!-- List every file you modified and briefly explain why. -->
38+
<!-- Do not list files you only read. -->
39+
40+
| File | Change made |
41+
|------|-------------|
42+
| `utils/recommender.py` | Added `clear_cache()` function |
43+
| `tests/test_basic.py` | Added test for cache invalidation |
44+
45+
## How to Test This PR [required]
46+
47+
<!-- Exact steps a reviewer can follow to verify your change works. -->
48+
<!-- "It works on my machine" is not sufficient. -->
49+
50+
1. Clone this branch: `git checkout your-branch-name`
51+
2. Install dependencies: `pip install -r requirements.txt`
52+
3. Run the app: `python app.py`
53+
4. Open http://127.0.0.1:5000 and...
54+
5. Run the tests: `python tests/test_basic.py`
55+
56+
Expected test output:
57+
```
58+
27 passed, 0 failed out of 27 tests
59+
```
60+
61+
## Test Results [required]
62+
63+
<!-- Paste the full output of python tests/test_basic.py -->
64+
65+
```
66+
paste output here
67+
```
68+
69+
## Screenshots (if UI change)
70+
71+
<!-- Before and after screenshots for any visual change. -->
72+
<!-- Remove this section if your PR has no visual change. -->
73+
74+
| Before | After |
75+
|--------|-------|
76+
| screenshot | screenshot |
77+
78+
## Self-Review Checklist [required]
79+
80+
<!-- Complete every item before requesting review. -->
81+
<!-- Do not submit a PR you would not approve yourself. -->
82+
83+
- [ ] I have read [CONTRIBUTING.md](../CONTRIBUTING.md) and followed all guidelines
84+
- [ ] My branch name follows the convention: `feat/`, `fix/`, `docs/`, `data/`, `style/`, `test/`
85+
- [ ] I have run `python tests/test_basic.py` and all 27 tests pass
86+
- [ ] I have run `flake8 .` locally and there are no errors
87+
- [ ] I have not introduced any `print()` or `console.log()` debug statements
88+
- [ ] Every new function I wrote has a docstring
89+
- [ ] I have not modified files outside the scope of the linked issue
90+
- [ ] If I changed the UI, I tested it at 375px (mobile) and 1280px (desktop)
91+
- [ ] If I added a project to the dataset, it has all required JSON fields
92+
93+
## Notes for Reviewer
94+
95+
<!-- Anything you want the reviewer to pay particular attention to. -->
96+
<!-- Or "None" if there is nothing unusual. -->
97+
98+

‎SECURITY.md‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
# Security Policy
2+
3+
## Supported Versions
4+
5+
DevPath is currently in active development. Security fixes are applied to
6+
the latest version on the `main` branch only.
7+
8+
| Version | Supported |
9+
|---------|-----------|
10+
| Latest (`main`) | Yes |
11+
| Older branches | No |
12+
13+
---
14+
15+
## Reporting a Vulnerability
16+
17+
If you discover a security vulnerability in DevPath, **do not open a public
18+
GitHub Issue**. Public disclosure before a fix is available puts all users
19+
of the project at risk.
20+
21+
**How to report:**
22+
23+
1. Open a [GitHub Security Advisory](https://github.com/your-username/devpath/security/advisories/new)
24+
on this repository (private by default).
25+
2. Include a clear description of the vulnerability, steps to reproduce it,
26+
and your assessment of its impact.
27+
3. You will receive an acknowledgement within 48 hours.
28+
29+
**What to expect:**
30+
31+
- Acknowledgement within 48 hours of your report
32+
- An assessment of severity and impact within 5 business days
33+
- A fix or mitigation plan shared with you before public disclosure
34+
- Credit in the changelog if you wish to be named
35+
36+
---
37+
38+
## Scope
39+
40+
The following are in scope for security reports:
41+
42+
- Path traversal or file disclosure in the starter code serving routes
43+
- Injection vulnerabilities in the recommendation API
44+
- Information disclosure through error messages
45+
- Dependencies with known CVEs that affect the application
46+
47+
The following are out of scope:
48+
49+
- Vulnerabilities in development-mode Flask debug server (never use in production)
50+
- Self-XSS or issues requiring physical access to the machine
51+
- Denial of service via intentional resource exhaustion
52+
53+
---
54+
55+
## Known Security Considerations
56+
57+
### Development server
58+
59+
`python app.py` starts Flask in debug mode. The debug server must never be
60+
exposed to the public internet. For production deployment, use a WSGI server
61+
such as Gunicorn behind a reverse proxy.
62+
63+
### Path traversal mitigation
64+
65+
The `utils/file_server.py` module uses `os.path.basename()` to strip any
66+
directory components from starter code paths before resolving them. This
67+
prevents a crafted `starter_code` value in `projects.json` from reading
68+
arbitrary files.
69+
70+
### No user input is stored
71+
72+
DevPath does not persist user input. The recommendation API reads inputs from
73+
the request body, processes them in memory, and returns a response. No session
74+
data, no database, no user-submitted content is written to disk.
75+
76+
---
77+
78+
## Dependency Security
79+
80+
Dependencies are pinned in `requirements.txt`. Contributors should not upgrade
81+
dependencies without a review of the changelog for that package. If you
82+
discover that a pinned dependency has a known CVE, please report it using the
83+
process above.

0 commit comments

Comments
 (0)