docs(scripts): improve README, CONTRIBUTING, and test runner scripts by pankaj-bind · Pull Request #41 · pankaj-bind/AccountSafe

pankaj-bind · 2026-03-27T01:59:59Z

Type of Change

Select the type of change:

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
Refactoring (code restructuring without changing functionality)
Documentation update
Performance improvement
Security patch

Description

What does this PR do?

A clear and concise description of your changes.

Related Issue

Link to the issue this PR addresses:

Closes #(issue number)

Changes Made

List the specific changes you've made:

Changed X to Y in file A
Added new component B
Refactored function C
Updated documentation for D

Screenshots

For UI changes, provide before/after screenshots:

Before

After

Testing

How has this been tested?

Tested on Desktop (Chrome, Firefox, Safari)
Tested on Mobile (iOS Safari, Chrome Mobile)
Tested on Tablet
Added new unit tests
All existing tests pass
Manual testing completed

Test scenarios:

Scenario 1: Description of what you tested
Scenario 2: Description of what you tested

Checklist

Before submitting, confirm:

Frontend Changes (if applicable)

TypeScript types are properly defined
Component uses Tailwind CSS (no inline styles)
Responsive design tested on multiple screen sizes
Accessibility (ARIA labels, keyboard navigation) considered
Dark mode compatibility verified

Backend Changes (if applicable)

Follows PEP 8 style guide
Database migrations created (if schema changed)
API endpoint documentation updated
Input validation implemented
Security best practices followed
No sensitive data logged

Security Considerations

Does this PR introduce any security concerns?

No security impact
Security review required
Handles sensitive data (encryption implemented)
Changes authentication/authorization logic
Adds new external dependencies

If security-sensitive, describe the measures taken:

Breaking Changes

Does this PR introduce breaking changes?

No
Yes (describe below)

If yes, describe the breaking changes and migration path:

Additional Notes

Any additional information reviewers should know:

Deployment Notes

Special deployment steps required:

Reviewer Checklist:

Code quality and style approved
Tests are adequate and passing
Documentation is clear and complete
No security vulnerabilities introduced
Performance impact is acceptable

vercel · 2026-03-27T02:00:04Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
accountsafe	Ready	Preview, Comment	Mar 27, 2026 2:00am

Copilot

Pull request overview

This PR focuses on improving developer documentation and local tooling ergonomics, mainly by updating READMEs/CONTRIBUTING guidance and simplifying the test runner scripts, with a small tweak to local Nginx routing for static/media.

Changes:

Simplify/standardize output and paths in the cross-platform test runner scripts.
Expand README/CONTRIBUTING with clearer setup, testing, and troubleshooting instructions.
Adjust local Nginx handling for /static/ (try local first, fall back to backend) and proxy /media/ to backend.

Reviewed changes

Copilot reviewed 12 out of 14 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
scripts/run_tests.sh	Simplified banner/output; updated backend/frontend paths relative to `scripts/`.
scripts/run_tests.bat	Simplified banner/output; updated backend/frontend paths relative to `scripts\`.
README.md	Large overhaul: prerequisites, Docker/native setup, testing instructions, troubleshooting, deployment section.
CONTRIBUTING.md	Expanded contributor guidance: prerequisites, setup steps, project structure, testing + PR process.
SECURITY.md	Minor wording/punctuation edits in security policy text.
frontend/public/docs/SECURITY.md	Mirror of SECURITY policy text for frontend docs.
frontend/nginx.local.conf	Refined `/static/` handling with fallback to backend; `/media/` proxies to backend.
frontend/src/index.css	Comment typography normalization (em dash → hyphen) in design system comments.
backend/api/tests/test_zero_knowledge.py	Comment/docstring typography normalization (em dash → hyphen).
backend/api/features/auth/zero_knowledge.py	Comment typography normalization.
backend/api/features/auth/services.py	Comment typography normalization.
.github/workflows/ci.yml	Comment typography normalization.
package-lock.json	Lockfile metadata update (peer flag) for root docs-related dependencies.
frontend/package-lock.json	Lockfile metadata normalization (removal of many `peer` flags).

Files not reviewed (1)

frontend/package-lock.json: Language not supported

Copilot · 2026-03-27T02:04:51Z

scripts/run_tests.bat

 REM Usage:
-REM   run_tests.bat           - Run all tests
-REM   run_tests.bat backend   - Run only backend tests
-REM   run_tests.bat frontend  - Run only frontend tests
+REM   run_tests.bat             Run all tests
+REM   run_tests.bat backend     Run backend tests only
+REM   run_tests.bat frontend    Run frontend tests only


The usage examples imply running run_tests.bat from the current directory, but the file lives under scripts\. Either update the usage block to scripts\run_tests.bat ... (for running from repo root) or explicitly state it should be run after cd scripts.

Copilot · 2026-03-27T02:04:52Z

README.md

+scripts\run_tests.bat            # all tests
+scripts\run_tests.bat backend    # backend only
+scripts\run_tests.bat frontend   # frontend only


This Windows test command block is inconsistent: after cd scripts, scripts\run_tests.bat would resolve to scripts\scripts\run_tests.bat and fail. Use run_tests.bat ... after cd scripts, or remove the cd scripts and keep scripts\run_tests.bat ... from the repo root.

Suggested change

scripts\run_tests.bat # all tests

scripts\run_tests.bat backend # backend only

scripts\run_tests.bat frontend # frontend only

run_tests.bat # all tests

run_tests.bat backend # backend only

run_tests.bat frontend # frontend only

Copilot · 2026-03-27T02:04:52Z

SECURITY.md

 #### Duress Mode Is Intentional (Not a Backdoor)

-Similarly, if you discover a secondary authentication path that reveals different vault contents—**this is the Duress Mode (Ghost Vault) feature**.
+Similarly, if you discover a secondary authentication path that reveals different vault contents-**this is the Duress Mode (Ghost Vault) feature**.


Same punctuation issue here: add spaces around the dash (or restore the em dash) before the bold phrase so the sentence reads correctly in Markdown.

Suggested change

Similarly, if you discover a secondary authentication path that reveals different vault contents-**this is the Duress Mode (Ghost Vault) feature**.

Similarly, if you discover a secondary authentication path that reveals different vault contents — **this is the Duress Mode (Ghost Vault) feature**.

Copilot · 2026-03-27T02:04:53Z

frontend/public/docs/SECURITY.md

 #### Canary Traps Are Intentional (Not Vulnerabilities)

-If you are auditing AccountSafe and discover credentials that appear to trigger alerts, logging mechanisms, or "phone home" behavior—**this is by design**.
+If you are auditing AccountSafe and discover credentials that appear to trigger alerts, logging mechanisms, or "phone home" behavior-**this is by design**.


There should be spacing around the dash (or use an em dash) before the bold text. As written (behavior-**this is by design**) it reads like a hyphenated word and renders awkwardly in Markdown.

Suggested change

If you are auditing AccountSafe and discover credentials that appear to trigger alerts, logging mechanisms, or "phone home" behavior-**this is by design**.

If you are auditing AccountSafe and discover credentials that appear to trigger alerts, logging mechanisms, or "phone home" behavior - **this is by design**.

Copilot · 2026-03-27T02:04:53Z

frontend/public/docs/SECURITY.md

 #### Duress Mode Is Intentional (Not a Backdoor)

-Similarly, if you discover a secondary authentication path that reveals different vault contents—**this is the Duress Mode (Ghost Vault) feature**.
+Similarly, if you discover a secondary authentication path that reveals different vault contents-**this is the Duress Mode (Ghost Vault) feature**.


Same punctuation issue here: add spaces around the dash (or restore the em dash) before the bold phrase so the sentence reads correctly in Markdown.

Suggested change

Similarly, if you discover a secondary authentication path that reveals different vault contents-**this is the Duress Mode (Ghost Vault) feature**.

Similarly, if you discover a secondary authentication path that reveals different vault contents - **this is the Duress Mode (Ghost Vault) feature**.

Copilot · 2026-03-27T02:04:53Z

frontend/nginx.local.conf

    location /media/ {
        proxy_pass http://backend:8000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;


In the /media/ proxy block you only set Host and X-Real-IP, but the backend reads HTTP_X_FORWARDED_FOR (client IP) and may rely on HTTP_X_FORWARDED_PROTO for secure redirects. Consider adding X-Forwarded-For and X-Forwarded-Proto here (consistent with the /api/, /admin/, and @backend_static blocks).

Suggested change

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_set_header X-Forwarded-Proto $scheme;

Copilot · 2026-03-27T02:04:54Z

README.md

 | Database | PostgreSQL 15+ |
 | Encryption | AES-256-GCM (Web Crypto API) |
-| Key Derivation | PBKDF2 (600k iterations) / Argon2id |
+| Key Derivation | PBKDF2 (600k iterations) |


The architecture table now states key derivation is PBKDF2-only, but the frontend crypto implementation currently derives keys with Argon2id (see frontend/src/services/cryptoService.ts), and there is also PBKDF2-based code under frontend/src/utils/encryption.ts. The README should reflect the actual KDF(s) used so security claims stay accurate.

Suggested change

| Key Derivation | PBKDF2 (600k iterations) |

| Key Derivation | Argon2id (frontend) and PBKDF2 (600k iterations, compatibility) |

Copilot · 2026-03-27T02:04:54Z

scripts/run_tests.sh

+#   ./run_tests.sh              Run all tests
+#   ./run_tests.sh backend      Run backend tests only
+#   ./run_tests.sh frontend     Run frontend tests only
+#   ./run_tests.sh --coverage   Run with coverage reports


The usage examples imply running the script as ./run_tests.sh, but this file lives under scripts/. If invoked from the repo root, the correct path is ./scripts/run_tests.sh (or clarify that users should cd scripts first). Updating the usage block will prevent confusion.

Suggested change

# ./run_tests.sh Run all tests

# ./run_tests.sh backend Run backend tests only

# ./run_tests.sh frontend Run frontend tests only

# ./run_tests.sh --coverage Run with coverage reports

# ./scripts/run_tests.sh Run all tests

# ./scripts/run_tests.sh backend Run backend tests only

# ./scripts/run_tests.sh frontend Run frontend tests only

# ./scripts/run_tests.sh --coverage Run with coverage reports

Copilot · 2026-03-27T02:04:54Z

SECURITY.md

 #### Canary Traps Are Intentional (Not Vulnerabilities)

-If you are auditing AccountSafe and discover credentials that appear to trigger alerts, logging mechanisms, or "phone home" behavior—**this is by design**.
+If you are auditing AccountSafe and discover credentials that appear to trigger alerts, logging mechanisms, or "phone home" behavior-**this is by design**.


There should be spacing around the dash (or use an em dash) before the bold text. As written (behavior-**this is by design**) it reads like a hyphenated word and renders awkwardly in Markdown.

Suggested change

If you are auditing AccountSafe and discover credentials that appear to trigger alerts, logging mechanisms, or "phone home" behavior-**this is by design**.

If you are auditing AccountSafe and discover credentials that appear to trigger alerts, logging mechanisms, or "phone home" behavior — **this is by design**.

docs(scripts): improve README, CONTRIBUTING, and test runner scripts

f9701ec

Copilot AI review requested due to automatic review settings March 27, 2026 02:00

pankaj-bind merged commit e4a2dff into main Mar 27, 2026
5 checks passed

Copilot started reviewing on behalf of pankaj-bind March 27, 2026 02:00 View session

Copilot AI reviewed Mar 27, 2026

View reviewed changes

pankaj-bind deleted the feat/ci-github-actions branch April 4, 2026 18:58

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

docs(scripts): improve README, CONTRIBUTING, and test runner scripts#41

docs(scripts): improve README, CONTRIBUTING, and test runner scripts#41
pankaj-bind merged 1 commit intomainfrom
feat/ci-github-actions

pankaj-bind commented Mar 27, 2026

Uh oh!

vercel bot commented Mar 27, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 27, 2026

Uh oh!

Copilot AI Mar 27, 2026

Uh oh!

Copilot AI Mar 27, 2026

Uh oh!

Copilot AI Mar 27, 2026

Uh oh!

Copilot AI Mar 27, 2026

Uh oh!

Copilot AI Mar 27, 2026

Uh oh!

Copilot AI Mar 27, 2026

Uh oh!

Copilot AI Mar 27, 2026

Uh oh!

Copilot AI Mar 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	Similarly, if you discover a secondary authentication path that reveals different vault contents-this is the Duress Mode (Ghost Vault) feature.
	Similarly, if you discover a secondary authentication path that reveals different vault contents — this is the Duress Mode (Ghost Vault) feature.

	If you are auditing AccountSafe and discover credentials that appear to trigger alerts, logging mechanisms, or "phone home" behavior-this is by design.
	If you are auditing AccountSafe and discover credentials that appear to trigger alerts, logging mechanisms, or "phone home" behavior - this is by design.

	\| Key Derivation \| PBKDF2 (600k iterations) \|
	\| Key Derivation \| Argon2id (frontend) and PBKDF2 (600k iterations, compatibility) \|

Conversation

pankaj-bind commented Mar 27, 2026

Type of Change

Description

Related Issue

Changes Made

Screenshots

Before

After

Testing

Checklist

Frontend Changes (if applicable)

Backend Changes (if applicable)

Security Considerations

Breaking Changes

Additional Notes

Deployment Notes

Uh oh!

vercel bot commented Mar 27, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants