Docs/add security policy - #89
Conversation
|
@Myparadox-creator is attempting to deploy a commit to the itzzavdhesh's projects Team on Vercel. A member of the Team first needs to authorize it. |
|
Warning Review limit reached
Next review available in: 52 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (5)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
✅ Thanks! This PR is linked to #83 and will close it automatically when merged. |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
7 issues found across 6 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="src/App.tsx">
<violation number="1" location="src/App.tsx:273">
P2: Duplicating a decision with populated branches creates a second unconnected source: the copy keeps the original yes/no targets, but this branch never rewires an incoming edge to the new ID. A decision-specific insertion strategy, or disabling duplication when its connection cannot be preserved, would avoid adding an unexpected orphaned flow node.</violation>
<violation number="2" location="src/App.tsx:320">
P2: Keyboard navigation is broken once this global listener is mounted: Tab from toolbar, sidebar, or modal buttons is intercepted to cycle blocks instead of moving focus, and Delete/Backspace can remove the selected block while the help dialog is open. Scoping shortcuts to the canvas or excluding all interactive/modal targets before handling these keys would preserve native control behavior and prevent destructive actions behind the dialog.</violation>
</file>
<file name="src/hooks/useKeyboardShortcuts.ts">
<violation number="1" location="src/hooks/useKeyboardShortcuts.ts:133">
P2: Arrow navigation can leave the app with a selected ID that has no block when a workspace contains a dangling target, causing the properties panel to lose the selection and skipping the array fallback. Only select `nextId` when it exists in `blocks`; otherwise continue to the fallback block.</violation>
</file>
<file name="src/components/CenterCanvas.tsx">
<violation number="1" location="src/components/CenterCanvas.tsx:408">
P2: The Export dropdown is clipped below the 64px toolbar, so most or all export options are not visible when the menu opens. Keep horizontal scrolling on a wrapper and render the dropdown outside the scroll container, or otherwise avoid putting the menu inside an element with scrolling overflow.</violation>
<violation number="2" location="src/components/CenterCanvas.tsx:450">
P3: Screen-reader users cannot identify the icon-only button that closes the Keyboard Shortcuts dialog. Give the button an accessible name such as `aria-label="Close keyboard shortcuts"`.</violation>
<violation number="3" location="src/components/CenterCanvas.tsx:513">
P2: The new shortcuts help modal and export dropdown use animation CSS classes (`animate-fade-in`, `animate-in`, `fade-in`, `zoom-in-95`) that are not defined in the project. Tailwind CSS v4 does not include them as built-ins, the `tailwindcss-animate` plugin is not installed, and no custom `@keyframes` are defined. These classes have no visual effect — the modal and dropdown appear/disappear instantly. Either install `tailwindcss-animate` (which provides `animate-in`, `fade-in`, `zoom-in`), define custom `@keyframes` in `index.css`, or remove the non-functional class names.</violation>
<violation number="4" location="src/components/CenterCanvas.tsx:928">
P2: While the shortcuts dialog is open, keyboard input can change or delete the flowchart, and Tab cannot move focus to the dialog's close controls; Escape also does not close the dialog. Suspend diagram shortcuts while the dialog is open and provide modal Escape/focus handling.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
| if (idx === -1) return [...prev, duplicatedBlock]; | ||
|
|
||
| const updated = [...prev]; | ||
| if (original.type !== 'decision') { |
There was a problem hiding this comment.
P2: Duplicating a decision with populated branches creates a second unconnected source: the copy keeps the original yes/no targets, but this branch never rewires an incoming edge to the new ID. A decision-specific insertion strategy, or disabling duplication when its connection cannot be preserved, would avoid adding an unexpected orphaned flow node.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At src/App.tsx, line 273:
<comment>Duplicating a decision with populated branches creates a second unconnected source: the copy keeps the original yes/no targets, but this branch never rewires an incoming edge to the new ID. A decision-specific insertion strategy, or disabling duplication when its connection cannot be preserved, would avoid adding an unexpected orphaned flow node.</comment>
<file context>
@@ -251,6 +253,37 @@ export default function App() {
+ if (idx === -1) return [...prev, duplicatedBlock];
+
+ const updated = [...prev];
+ if (original.type !== 'decision') {
+ duplicatedBlock.targetId = original.targetId;
+ updated[idx] = { ...original, targetId: newId };
</file context>
| } | ||
| }; | ||
|
|
||
| useKeyboardShortcuts({ |
There was a problem hiding this comment.
P2: Keyboard navigation is broken once this global listener is mounted: Tab from toolbar, sidebar, or modal buttons is intercepted to cycle blocks instead of moving focus, and Delete/Backspace can remove the selected block while the help dialog is open. Scoping shortcuts to the canvas or excluding all interactive/modal targets before handling these keys would preserve native control behavior and prevent destructive actions behind the dialog.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At src/App.tsx, line 320:
<comment>Keyboard navigation is broken once this global listener is mounted: Tab from toolbar, sidebar, or modal buttons is intercepted to cycle blocks instead of moving focus, and Delete/Backspace can remove the selected block while the help dialog is open. Scoping shortcuts to the canvas or excluding all interactive/modal targets before handling these keys would preserve native control behavior and prevent destructive actions behind the dialog.</comment>
<file context>
@@ -284,6 +317,17 @@ export default function App() {
}
};
+ useKeyboardShortcuts({
+ blocks,
+ selectedBlockId,
</file context>
| e.key === 'ArrowRight' | ||
| ? currentBlock.yesTargetId || currentBlock.noTargetId | ||
| : currentBlock.noTargetId || currentBlock.yesTargetId; | ||
| if (nextId) { |
There was a problem hiding this comment.
P2: Arrow navigation can leave the app with a selected ID that has no block when a workspace contains a dangling target, causing the properties panel to lose the selection and skipping the array fallback. Only select nextId when it exists in blocks; otherwise continue to the fallback block.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At src/hooks/useKeyboardShortcuts.ts, line 133:
<comment>Arrow navigation can leave the app with a selected ID that has no block when a workspace contains a dangling target, causing the properties panel to lose the selection and skipping the array fallback. Only select `nextId` when it exists in `blocks`; otherwise continue to the fallback block.</comment>
<file context>
@@ -0,0 +1,184 @@
+ e.key === 'ArrowRight'
+ ? currentBlock.yesTargetId || currentBlock.noTargetId
+ : currentBlock.noTargetId || currentBlock.yesTargetId;
+ if (nextId) {
+ onSelectBlock(nextId);
+ return;
</file context>
| )} | ||
|
|
||
| {/* Keyboard Shortcuts Help Modal */} | ||
| {showShortcutsHelp && ( |
There was a problem hiding this comment.
P2: While the shortcuts dialog is open, keyboard input can change or delete the flowchart, and Tab cannot move focus to the dialog's close controls; Escape also does not close the dialog. Suspend diagram shortcuts while the dialog is open and provide modal Escape/focus handling.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At src/components/CenterCanvas.tsx, line 928:
<comment>While the shortcuts dialog is open, keyboard input can change or delete the flowchart, and Tab cannot move focus to the dialog's close controls; Escape also does not close the dialog. Suspend diagram shortcuts while the dialog is open and provide modal Escape/focus handling.</comment>
<file context>
@@ -878,6 +923,60 @@ export default function CenterCanvas({
)}
+
+ {/* Keyboard Shortcuts Help Modal */}
+ {showShortcutsHelp && (
+ <div className="fixed inset-0 bg-slate-900/50 backdrop-blur-xs z-50 flex items-center justify-center p-4 animate-fade-in">
+ <div className="bg-white dark:bg-slate-800 rounded-2xl shadow-2xl border border-gray-100 dark:border-slate-700 max-w-md w-full p-6 transform transition-all scale-100">
</file context>
| {/* Top Toolbar */} | ||
| <header className="h-[64px] bg-white dark:bg-slate-800 border-b border-gray-100 dark:border-slate-700 shadow-xs px-6 flex items-center justify-between shrink-0 select-none z-10"> | ||
| <div className="flex items-center gap-2"> | ||
| <header className="h-[64px] bg-white dark:bg-slate-800 border-b border-gray-100 dark:border-slate-700 shadow-xs px-4 flex items-center justify-between shrink-0 select-none z-10 overflow-x-auto overflow-y-visible custom-scrollbar flex-nowrap min-w-0 max-w-full"> |
There was a problem hiding this comment.
P2: The Export dropdown is clipped below the 64px toolbar, so most or all export options are not visible when the menu opens. Keep horizontal scrolling on a wrapper and render the dropdown outside the scroll container, or otherwise avoid putting the menu inside an element with scrolling overflow.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At src/components/CenterCanvas.tsx, line 408:
<comment>The Export dropdown is clipped below the 64px toolbar, so most or all export options are not visible when the menu opens. Keep horizontal scrolling on a wrapper and render the dropdown outside the scroll container, or otherwise avoid putting the menu inside an element with scrolling overflow.</comment>
<file context>
@@ -383,19 +405,19 @@ export default function CenterCanvas({
{/* Top Toolbar */}
- <header className="h-[64px] bg-white dark:bg-slate-800 border-b border-gray-100 dark:border-slate-700 shadow-xs px-6 flex items-center justify-between shrink-0 select-none z-10">
- <div className="flex items-center gap-2">
+ <header className="h-[64px] bg-white dark:bg-slate-800 border-b border-gray-100 dark:border-slate-700 shadow-xs px-4 flex items-center justify-between shrink-0 select-none z-10 overflow-x-auto overflow-y-visible custom-scrollbar flex-nowrap min-w-0 max-w-full">
+ <div className="flex items-center gap-2 shrink-0">
<span className="text-xs font-semibold uppercase tracking-wider text-gray-400 dark:text-slate-500">Workspace</span>
</file context>
| Export PPTX | ||
| </button> | ||
| {showExportMenu && ( | ||
| <div className="absolute right-0 mt-2 w-48 bg-white dark:bg-slate-800 rounded-xl shadow-xl border border-gray-100 dark:border-slate-700 py-1.5 z-50 animate-in fade-in zoom-in-95 duration-100"> |
There was a problem hiding this comment.
P2: The new shortcuts help modal and export dropdown use animation CSS classes (animate-fade-in, animate-in, fade-in, zoom-in-95) that are not defined in the project. Tailwind CSS v4 does not include them as built-ins, the tailwindcss-animate plugin is not installed, and no custom @keyframes are defined. These classes have no visual effect — the modal and dropdown appear/disappear instantly. Either install tailwindcss-animate (which provides animate-in, fade-in, zoom-in), define custom @keyframes in index.css, or remove the non-functional class names.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At src/components/CenterCanvas.tsx, line 513:
<comment>The new shortcuts help modal and export dropdown use animation CSS classes (`animate-fade-in`, `animate-in`, `fade-in`, `zoom-in-95`) that are not defined in the project. Tailwind CSS v4 does not include them as built-ins, the `tailwindcss-animate` plugin is not installed, and no custom `@keyframes` are defined. These classes have no visual effect — the modal and dropdown appear/disappear instantly. Either install `tailwindcss-animate` (which provides `animate-in`, `fade-in`, `zoom-in`), define custom `@keyframes` in `index.css`, or remove the non-functional class names.</comment>
<file context>
@@ -465,42 +488,64 @@ export default function CenterCanvas({
- Export PPTX
- </button>
+ {showExportMenu && (
+ <div className="absolute right-0 mt-2 w-48 bg-white dark:bg-slate-800 rounded-xl shadow-xl border border-gray-100 dark:border-slate-700 py-1.5 z-50 animate-in fade-in zoom-in-95 duration-100">
+ <button
+ onClick={() => { handleExportPNG(); setShowExportMenu(false); }}
</file context>
| {isDarkMode ? <Sun className="w-4 h-4" /> : <Moon className="w-4 h-4" />} | ||
| </button> | ||
|
|
||
| <button |
There was a problem hiding this comment.
P3: Screen-reader users cannot identify the icon-only button that closes the Keyboard Shortcuts dialog. Give the button an accessible name such as aria-label="Close keyboard shortcuts".
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At src/components/CenterCanvas.tsx, line 450:
<comment>Screen-reader users cannot identify the icon-only button that closes the Keyboard Shortcuts dialog. Give the button an accessible name such as `aria-label="Close keyboard shortcuts"`.</comment>
<file context>
@@ -416,47 +438,48 @@ export default function CenterCanvas({
{isDarkMode ? <Sun className="w-4 h-4" /> : <Moon className="w-4 h-4" />}
</button>
+ <button
+ id="toolbar-btn-shortcuts"
+ onClick={onToggleShortcutsHelp}
</file context>
| <button | |
| <button aria-label="Close keyboard shortcuts" |
1 participant
Description
This PR adds a standard
SECURITY.mdfile to the root of the repository to establish a clear, responsible vulnerability disclosure process for FlowCraft.Why this approach?
Without a dedicated security policy, security researchers and open-source contributors might default to reporting sensitive security vulnerabilities in public GitHub issues, exposing potential exploits or zero-day flaws to the public before a patch can be developed.
Summary of changes:
1.x.x).security@flowcraft.dev).Related Issue
Closes #83
Type of Change
Summary by cubic
Adds a
SECURITY.mdwith a clear, private vulnerability disclosure process and introduces keyboard shortcuts with a help modal plus a unified Export menu to speed up editing and exports.New Features
Documentation
SECURITY.md: supports1.x.x, private reporting via GitHub Private Vulnerability Reporting orsecurity@flowcraft.dev, report guidelines (PoC, impact, env), and SLAs (48h ack, triage, coordinated disclosure).Written for commit 05e242e. Summary will update on new commits.