maalik-e-makaan

The source is in a public Git repository on GitHub that anyone can read and clone without signing in. It holds the Flutter app, the Supabase migrations and Edge Functions, the Astro website, the formal models and the CI workflows.

URL: https://github.com/ar27111994/maalik-e-makaan

Git records what changed, who made the change and when for every commit, and GitHub keeps the pull request, review and CI history for each one. After the initial commit, every change has reached main through a pull request. The project's convention is a squash merge with a Conventional Commit title, which commitlint checks in a lefthook commit-msg hook and in CI, and pr-title.yml checks the pull request title.

URL: https://github.com/ar27111994/maalik-e-makaan/commits/main

The repository holds work between releases, not only final releases. Every change is a public pull request whose individual commits and CI runs stay visible (PR #1 has 107 commits), and main already has several merged changes (#1, #13, #14) before the first release is cut by its own release pull request.

URL: https://github.com/ar27111994/maalik-e-makaan/pull/1/commits

The project uses Git, a distributed version control system, hosted on GitHub.

URL: https://github.com/ar27111994/maalik-e-makaan

Each release gets a unique version number, vX.Y.Z, from release-please, starting with v1.0.0. The release pull request writes the number into app/pubspec.yaml and website/package.json. The Release workflow builds with it (--build-name) and names each artefact with the tag, for example maalik-e-makaan-v1.0.0-web.zip.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/release-please-config.json

Each release is marked with a Git tag, vX.Y.Z (include-v-in-tag in release-please-config.json). Merging the release pull request creates the tag and the GitHub release, and the Release workflow builds and attaches that tag's artefacts with provenance attestations.

URL: https://github.com/ar27111994/maalik-e-makaan/tags

Each release has human-readable release notes: release-please writes CHANGELOG.md and the GitHub release from Conventional Commit titles, grouped by kind. The v1.0.0 notes list the release's main features (portfolios and team roles, the rent ledger, receipts, caretakers, police registration, tax-year statements, WhatsApp reminders, the bilingual app and website).

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/CHANGELOG.md

No publicly known run-time vulnerability has been fixed in the project's own code: it has no CVE assignments, and its list of GitHub security advisories is empty. Vulnerabilities are reported privately through GitHub security advisories (SECURITY.md). When a release fixes a published advisory, its release notes will name the GHSA or CVE ID.

URL: https://github.com/ar27111994/maalik-e-makaan/security/policy

Bugs are reported through GitHub Issues using a structured bug-report form (what happened, steps to reproduce, where it happened, app language, app version); blank issues are turned off so reporters are guided to the form. README.md (Contributing) and CONTRIBUTING.md (Reporting problems) point to the issue forms, and the website's privacy, terms and FAQ pages link to the issue tracker.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/.github/ISSUE_TEMPLATE/bug_report.yml

The project tracks individual issues in GitHub Issues, with bug-report and feature-request forms that apply the 'bug' and 'enhancement' labels automatically; pull requests are tracked in the same place.

URL: https://github.com/ar27111994/maalik-e-makaan/issues

The repository was created on 3 November 2026 and no bug reports have been filed yet: every item in the tracker so far is a pull request, so there are no unacknowledged reports. Bug reports come in through the bug-report form, which labels them 'bug', and the maintainer will acknowledge each one.

URL: https://github.com/ar27111994/maalik-e-makaan/issues?q=is%3Aissue

No enhancement requests have been filed since the repository was created on 3 November 2026, so none are waiting for a response. Requests come in through the feature-request form, which applies the 'enhancement' label, and the maintainer will respond to each one, even if the answer is no.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/.github/ISSUE_TEMPLATE/feature_request.yml

All issues and pull requests, open and closed, with their comments, stay publicly available and searchable in the GitHub issue tracker of this public repository.

URL: https://github.com/ar27111994/maalik-e-makaan/issues?q=

SECURITY.md, which GitHub shows as the repository's security policy, explains how to report a vulnerability: privately through GitHub security advisories, never in a public issue. It also covers what to include, response times, supported versions, scope and safe harbour. CONTRIBUTING.md and the website's privacy page (English and Urdu) link to the policy, and the issue chooser sends security reports to the private advisory form.

URL: https://github.com/ar27111994/maalik-e-makaan/security/policy

Private reports are supported: GitHub private vulnerability reporting is turned on for the repository, and SECURITY.md links directly to the private advisory form (security/advisories/new). Reports sent there go over HTTPS, and only the reporter and the repository's maintainers can see them. The issue chooser also sends security reports to this form, not to a public issue.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/SECURITY.md

No vulnerability reports have been received in the last 6 months: the repository has no security advisories in any state (triage, draft, published or closed), and it dates from November 2026. SECURITY.md commits to acknowledging a report within 3 working days, well inside the 14-day limit.

URL: https://github.com/ar27111994/maalik-e-makaan/security/advisories

Every deliverable is rebuilt from source by scripted commands: the root Makefile's make build-web-app (Flutter web release) and make build-apk (Android), npm run build in website/ (Astro), and flutter build ios for the unsigned iOS app. CI rebuilds all of them on every push and pull request (the web-build, android-build, ios-build and website jobs in ci.yml).

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/Makefile

The build uses common, standard tools: GNU Make as the single entry point, the Flutter/Dart CLI for the app and packages, npm scripts with Astro for the website, and Deno tasks for the Edge Functions.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/Makefile

The web app, website, Edge Functions, and database build and test with FLOSS tools only: Make, Flutter and Dart (BSD-3), Node, Astro, Deno, PostgreSQL and Python. Two native builds are exceptions. The Android APK uses Google's prebuilt Android SDK, which is released under Google's SDK licence, and the optional iOS build needs Apple's Xcode.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/CONTRIBUTING.md

The repository includes its automated test suites under the MIT licence: Dart unit, widget and golden tests; 21 pgTAP database suites and concurrency scenarios; Deno Edge Function tests; Vitest and Playwright website tests; Playwright browser UAT; and Python tooling tests. README.md and CONTRIBUTING.md document Make test and the per-area targets, and ci.yml runs them.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/README.md

Make test runs every fast suite. Each area also has its own target (make test-core, test-app, test-db, test-functions, test-web, test-uat), and these targets call each language's standard runner (dart test, flutter test, deno task test, npm test with Vitest, python -m unittest).

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/Makefile

Coverage gates in CI enforce high coverage: 100% line coverage for the mm_core domain library, 100% of lines, branches and functions for the Edge Functions, 95% of lines for the mm_ui design system and 90% for the app. Twenty-one pgTAP suites cover the database, including an RLS matrix and contract vectors shared with Dart. The website's Vitest and Playwright suites run in CI but have no numeric coverage gate.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/Makefile

GitHub Actions CI (ci.yml) runs on every push to main, on every pull request and in the merge queue. It runs formatting, linting, and analysis; every test suite with its coverage gate, pgTAP on PostgreSQL and on a full Supabase stack; Edge Function end-to-end tests; browser UAT; formal-model checks; and release builds. A single "CI passed" check, which needs every job, gates merges.

URL: https://github.com/ar27111994/maalik-e-makaan/actions/workflows/ci.yml

The policy is that new or changed functionality comes with automated tests. The pull request template requires "Tests cover the change, including edge cases and failure paths", and CONTRIBUTING.md requires pgTAP tests (and concurrency scenarios) for database changes. In the Dart packages, the app and the Edge Functions, CI's coverage gates also fail a change that adds code without tests.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/.github/pull_request_template.md

Recent major changes added tests along with the code. The v1.0 pull request (#1) shipped the app, backend and website with their unit, widget, golden, pgTAP, Edge Function, website and UAT suites. The iOS packaging change (#14) added tool/ios/test_package_unsigned_ipa.py next to the new script and updated the UAT journeys.

URL: https://github.com/ar27111994/maalik-e-makaan/pull/14

Every change proposal fills in the pull request template, which says "Tests cover the change, including edge cases and failure paths". CONTRIBUTING.md requires pgTAP tests and concurrency scenarios for database changes, and docs/agents/workflows.md lists the tests to add for each kind of change.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/.github/pull_request_template.md

Each language has a linter or a strict mode enabled. Dart and Flutter use very_good_analysis with strict-casts, strict-inference and strict-raw-types. The website uses TypeScript (Astro's strictest config), ESLint (typescript-eslint strictTypeChecked, jsx-a11y) and Stylelint. Edge Functions use Deno strict mode and deno lint, Python uses ruff, shell uses shellcheck, workflows use actionlint and migrations use squawk.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/app/analysis_options.yaml

Any warning fails CI, so warnings are fixed before a change merges: analyze --fatal-infos for Dart, --max-warnings=0 for ESLint and Stylelint, and deno lint, ruff and shellcheck all as gates. About 40 suppression comments are left outside generated code, each naming the specific rule and most giving a reason; 14 are reviewed squawk ignores in a single migration. ESLint reports unused disable directives as errors.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/.github/workflows/ci.yml

The analysers run at maximum or near-maximum strictness. Info-level Dart diagnostics are fatal under very_good_analysis plus the strict language modes, and TypeScript uses Astro's strictest config with typescript-eslint strictTypeChecked and stylisticTypeChecked. Deno runs with strict and noUncheckedIndexedAccess plus extra lint rules (eqeqeq, no-non-null-assertion), and ruff enables bugbear, bandit security checks and other rule sets.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/website/eslint.config.js

The project's only developer is its primary developer, and the design is recorded in docs/architecture/permissions.md. All authorisation is enforced in one place, the database, so every request is checked whichever client sends it (economy of mechanism, complete mediation). Access is denied by default: every table has row-level security and the anon role holds no privilege on any relation, which pgTAP checks in supabase/tests/database/01_schema_security.test.sql (fail-safe defaults). Clients hold only the publishable key, and column grants keep system-owned columns unwritable (least privilege). Supabase Auth offers TOTP multi-factor sign-in (separation of privilege). Stored values and invitation tokens must match allowlist formats (CHECK constraints and regular expressions). The design is public and depends only on keys and per-invitation random secrets (open design).

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/docs/architecture/permissions.md

The project counters the common errors for a web and mobile app on a database API, as its code and docs show. Missing authorisation: row-level security on every table, tested by the pgTAP RLS matrix (03_rls_matrix.test.sql). SQL injection: parameterised PostgREST and RPC calls, and every function pins search_path. Cross-site scripting: a strict Content-Security-Policy without inline scripts (website/vercel.json, docs/operations.md). Leaked secrets: the app refuses a secret key, and gitleaks scans the history in CI. Timing attacks: tokens are compared in constant time. Brute force: rate limits per user and per action. CSV formula injection: exported cells are guarded (app/lib/src/features/insights/presentation/csv.dart). CodeQL runs its security-and-quality queries on every change.

URL: https://github.com/ar27111994/maalik-e-makaan/blob/main/SECURITY.md