Repository navigation
Conversation
… documentation ### Description This PR addresses cross-platform validation issues in the smart-contract package and remediates credential exposure within the repository documentation. **Vulnerabilities & Security Defects Remediated:** * **Cross-Platform Validation Failure (`smart-contract/package.json`):** The TypeScript lint script (`lint:ts`) previously used POSIX-only environment-variable assignment syntax, which caused execution failures on Windows environments before ESLint could run. The script has been explicitly updated to utilize the `cross-env` dependency, ensuring reliable and consistent execution across all operating systems. * **Credential Exposure in Documentation (`README.md`):** A plaintext Supabase PostgreSQL password was previously committed inside a connection URL within the documentation. This has been completely scrubbed and replaced with environment-provided placeholders and clear instructions to use local `.env` files for configuration, mitigating the risk of secret leaks.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR addresses cross-platform validation issues in the smart-contract package and remediates credential exposure within the repository documentation.
Vulnerabilities & Security Defects Remediated:
smart-contract/package.json): The TypeScript lint script (lint:ts) previously used POSIX-only environment-variable assignment syntax, which caused execution failures on Windows environments before ESLint could run. The script has been explicitly updated to utilize thecross-envdependency, ensuring reliable and consistent execution across all operating systems.README.md): A plaintext Supabase PostgreSQL password was previously committed inside a connection URL within the documentation. This has been completely scrubbed and replaced with environment-provided placeholders and clear instructions to use local.envfiles for configuration, mitigating the risk of secret leaks.Note
Low Risk
Dev-script and documentation-only changes; no contract, auth, or data-handling logic is modified.
Overview
Makes
yarn lint:tswork on Windows by wrappingESLINT_USE_FLAT_CONFIG=falsewithcross-env, matching the other Hardhat scripts.Also updates the smart-contract README: credits are granted on agreement signing (not on first vote) and never regenerate, and voting requires the initiatives contract to be linked to the agreement contract.
Reviewed by Cursor Bugbot for commit 610684c. Bugbot is set up for automated code reviews on this repo. Configure here.