diff --git a/GEMINI.md b/GEMINI.md index 84528a9..7de197b 100644 --- a/GEMINI.md +++ b/GEMINI.md @@ -12,8 +12,7 @@ 1. **Security-first**: Never persist secrets (mnemonic/passphrase/private keys) to localStorage/sessionStorage/IndexedDB 2. **Small PRs**: Max 1-5 files per feature; propose plan before coding 3. **Client-side only**: No backend; all crypto runs in browser (Web Crypto API + OpenPGP.js) -4. **GitHub Pages deploy**: Base path `/seedpgp-web-app/` configured in vite.config.ts -5. **Honest security claims**: Don't overclaim what client-side JS can guarantee +4. **Honest security claims**: Don't overclaim what client-side JS can guarantee ## Non-Negotiables @@ -30,7 +29,7 @@ ### Entry Points - `src/main.tsx` → `src/App.tsx` (main application) -- Build output: `dist/` (separate git repo for GitHub Pages deployment) +- Build output: `dist/` ### Directory Structure @@ -125,7 +124,6 @@ bun run dev # Dev server (localhost:5173) bun run build # Build to dist/ bun run typecheck # TypeScript validation (tsc --noEmit) bun run preview # Preview production build -./scripts/deploy.sh v1.x.x # Build + push to public repo ``` ### Deployment Process @@ -140,14 +138,6 @@ bun run preview # Preview production build 3. **Output directory:** `dist/` 4. **Security headers:** Automatically enforced via `public/_headers` -### Benefits Over GitHub Pages - -- ✅ Real CSP header enforcement (blocks network requests at browser level) -- ✅ Custom security headers (X-Frame-Options, X-Content-Type-Options) -- ✅ Auto-deploy on push to main -- ✅ Build preview for PRs -- ✅ Better performance (global CDN) - ### Git Workflow ```bash @@ -167,9 +157,6 @@ git push origin main --tags # Then commit the README update: git add README.md git commit -m "docs: update README for v1.x.x" - -# Deploy to GitHub Pages -./scripts/deploy.sh v1.x.x ``` --- @@ -282,7 +269,6 @@ Before implementing any feature: ### Security Claims - Don't claim "RAM is wiped" (JavaScript can't force GC) -- Don't claim "offline mode" without real CSP headers (GitHub Pages can't set custom headers) - Don't promise protection against active browser compromise (XSS/extensions) ### Storage