feat: release Colour Tools 0.1.0

2026-08-31 21:21:35 +02:00
commit 0c1fc94b58
100 changed files with 17406 additions and 0 deletions
@@ -0,0 +1,50 @@
+# Security policy
+
+## Supported versions
+
+Security fixes are made on the current release line. Users should update to the
+latest published tag and verify the release ZIP against its `.sha256` sidecar.
+
+## Reporting a vulnerability
+
+Please report a suspected vulnerability privately to the repository owner via
+the contact channel shown on the
+[Gitea profile](https://git.add-ideas.de/lotobo) or a private Gitea message. Do
+not include private images, access tokens, unpublished exploit details or other
+sensitive material in a public issue.
+
+Include the affected version, browser and operating system; a minimal local
+reproduction; the expected impact; and whether the issue requires a crafted
+image, palette or colour string. You should receive acknowledgement within
+seven days. Coordinated disclosure is appreciated while a fix and release are
+prepared.
+
+## Security model
+
+Colour Tools is a static browser application. It has no application backend,
+account system, analytics endpoint or image-upload endpoint. All selected image
+bytes are decoded and processed locally. Saved palette entries use browser
+storage for the current origin. Clipboard, file picker, download and EyeDropper
+actions happen only after a user gesture and remain governed by browser
+permissions.
+
+File processing is deliberately bounded by encoded byte size, decoded pixel
+count and dimensions. Image palette extraction samples a bounded number of
+pixels and can run in a disposable worker. Object URLs and worker jobs are
+cancelled or released when replaced. Input is displayed as text or parsed by
+typed colour/image APIs; it is not evaluated as script or inserted as trusted
+HTML.
+
+Production hosts should serve the headers in
+[docs/PRIVACY-SECURITY.md](docs/PRIVACY-SECURITY.md), use HTTPS, keep MIME types
+correct, disable content sniffing and avoid injecting third-party scripts. A
+host can still observe ordinary HTTP metadata for the initial static-file
+request; “local-first” describes application data processing, not anonymity
+from the static host.
+
+## Out of scope
+
+Colour rendering differences between conforming browser/OS colour-management
+pipelines are not vulnerabilities by themselves. Likewise, an approximate
+colour-vision simulation is an educational preview, not a medical diagnosis or
+a complete accessibility guarantee.