Merge pull request #17 from sumitsahoo/dev

Add security policy and implement CodeQL analysis workflows

Author: sumitsahoo

.github/dependabot.yml

@@ -0,0 +1,35 @@
+version: 2
+updates:
+  # Keep GitHub Actions pinned to SHA and up to date
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    labels:
+      - "dependencies"
+      - "github-actions"
+
+  # Keep npm/pnpm dependencies up to date
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    labels:
+      - "dependencies"
+    groups:
+      react:
+        patterns:
+          - "react"
+          - "react-dom"
+          - "@types/react*"
+      tailwind:
+        patterns:
+          - "tailwindcss"
+          - "@tailwindcss/*"
+      pdf:
+        patterns:
+          - "pdf-lib"
+          - "pdfjs-dist"
+          - "@pdf-lib/*"

.github/workflows/codeql.yml

@@ -0,0 +1,41 @@
+name: CodeQL SAST
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Run every Monday at 09:00 UTC
+    - cron: "0 9 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (javascript-typescript)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+      actions: read
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: javascript-typescript
+          queries: security-and-quality
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: codeql-javascript

.github/workflows/deploy.yml

@@ -37,7 +37,7 @@ jobs:
           VITE_APP_BASE_PATH: /
 
       # - name: Test
-      #   run: vp run test
+      #   run: vp test
 
       - name: Setup Pages
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'

SECURITY.md

@@ -0,0 +1,30 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported |
+| ------- | --------- |
+| latest  | ✅        |
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in BytePDF, please **do not** open a public GitHub issue.
+
+Instead, report it privately via [GitHub Security Advisories](https://github.com/sumitsahoo/bytepdf/security/advisories/new).
+
+You can expect:
+
+- **Acknowledgement** within 48 hours
+- **Status update** within 7 days
+- Credit in the advisory once the fix is released (if desired)
+
+## Security Model
+
+BytePDF is a **client-side only** application — all PDF processing happens in your browser. No files or data are transmitted to any server. The attack surface is limited to:
+
+- Third-party npm dependencies (monitored via `pnpm audit` in CI and Dependabot)
+- Browser sandbox escape (out of scope — report to the browser vendor)
+
+## Dependency Vulnerabilities
+
+Known dependency vulnerabilities are tracked automatically via GitHub Dependabot and the weekly security audit workflow. If you spot one that has not been addressed, please follow the disclosure process above.