Dota 2 Mod Manager

The app updates itself through electron-updater, and every published release stays downloadable on the releases page, so an older copy can be updated or reinstalled at any time. The upgrade path needs no steps from the user: https://github.com/TheFleece/dota2-mod-manager/blob/main/RELEASING.md

GitHub Issues with templates: https://github.com/TheFleece/dota2-mod-manager/issues

No vulnerability report has been resolved in the last 12 months, so there is nobody to credit yet. SECURITY.md says reporters are credited in the release notes unless they ask not to be: https://github.com/TheFleece/dota2-mod-manager/blob/main/SECURITY.md

SECURITY.md documents it: reports go to a private GitHub advisory, a first reply comes within 48 hours, the current release is the one that gets fixed, and what is in scope and what belongs to the catalog authors is stated: https://github.com/TheFleece/dota2-mod-manager/blob/main/SECURITY.md

CONTRIBUTING.md states the style the repository keeps, and eslint.config.js is the machine-readable half of it. The linter is deliberately about code that cannot run rather than about formatting, which is recorded as a decision with its reason: https://github.com/TheFleece/dota2-mod-manager/blob/main/eslint.config.js

npm run verify runs eslint over the whole repository, the same gate runs in CI on every pull request, and a pre-commit hook refuses a commit that would break it.

No native binaries are produced. The app is JavaScript; electron-builder packages it with the Electron runtime, and there is no compiler or linker to pass CC, CFLAGS or LDFLAGS to.

Nothing is compiled or stripped. The JavaScript that ships is the JavaScript in this repository, readable inside the package.

There is no recursive build. Packaging is one electron-builder invocation over the whole project.

The app own code is JavaScript, used directly rather than compiled, so there is no generation step to repeat. What CI packages around it is an installer, which is not bit-for-bit reproducible; the answer to "did this file come from this source" is a Sigstore provenance attestation over every file in SHA256SUMS rather than a reproduction: https://github.com/TheFleece/dota2-mod-manager/blob/main/SECURITY.md

Windows gets an NSIS installer that appears in Add or Remove Programs, and a portable build that needs no installation. Linux gets an AppImage. Uninstalling is the same conventional route and the app asks what should go with it: https://github.com/TheFleece/dota2-mod-manager/blob/main/README.md

There is no POSIX-style installation step to honour DESTDIR or a prefix. The NSIS installer lets the user choose the folder and otherwise follows Windows conventions; the AppImage is a single file the user puts where they like.

git clone, npm install, npm start, and npm test run the app and its tests with two runtime dependencies and no build step. npm run sandbox:seed builds a throwaway Dota tree with real mods in it, so a developer never has to test against their own game: https://github.com/TheFleece/dota2-mod-manager/blob/main/CONTRIBUTING.md

package.json lists them, and every release carries a CycloneDX SBOM of what the app actually ships as dota2-mod-manager.cdx.json: https://github.com/TheFleece/dota2-mod-manager/blob/main/package.json

Dependabot watches the npm dependencies and the pinned GitHub Actions and opens pull requests for both, npm audit runs in CI on every push, and a scheduled job reports anything outstanding into the pinned status issue: https://github.com/TheFleece/dota2-mod-manager/blob/main/.github/dependabot.yml

The app ships two runtime dependencies, both from npm and neither vendored into this repository, so updating one is a version bump. Nothing is forked or copied in.

The runtime is kept current rather than pinned to an old line: Electron 44 and Node 24 today, with Dependabot opening the bumps. No deprecated Electron or Node API is knowingly used, and the type checker runs against the current typings with a ceiling that can only fall.

Every push and every pull request runs the suite on Linux and on Windows, and a separate job installs the built AppImage and clicks through installing, switching and removing a mod against a real Dota tree. Each run reports pass or fail as a required check: https://github.com/TheFleece/dota2-mod-manager/blob/main/.github/workflows/test.yml

Well above half: a fix carries a test or a line in the commit saying why it does not, and tools/pr-test-rule.mjs fails the pull request when neither is there. Incidents get a named guard of their own, held together by test/incidents.test.js: https://github.com/TheFleece/dota2-mod-manager/blob/main/tools/pr-test-rule.mjs

Statement coverage is above 83% of lines, measured on Linux and on Windows by node --test --experimental-test-coverage, and the gate refuses anything under 80%: https://github.com/TheFleece/dota2-mod-manager/blob/main/.github/coverage-baseline.json

CONTRIBUTING.md states it as a rule, and tools/pr-test-rule.mjs enforces it on every pull request: new behaviour arrives with a test, or the commit says No-Test-Because and why: https://github.com/TheFleece/dota2-mod-manager/blob/main/CONTRIBUTING.md

The policy is in CONTRIBUTING.md, in the section on what a good pull request looks like: https://github.com/TheFleece/dota2-mod-manager/blob/main/CONTRIBUTING.md

The linter is deliberately limited to correctness rather than style, so a failed lint means "this line will throw". Type checking gets stricter by construction: the number of type errors per file is written down and can only fall.

docs/assurance-case.md sets out the principles this app is built on and where each one lives: least privilege in the renderer, one door for every dangerous thing, failing in the direction that costs least on purpose, never running code fetched from the network, and checks that do not depend on one another: https://github.com/TheFleece/dota2-mod-manager/blob/main/docs/assurance-case.md

No broken or weakened algorithm decides whether anything is trusted.

The app stores no authentication credential and no private key. Signing in with Discord uses the token once to read a name and an avatar and then discards it; what is kept is an id, a name and a picture, in the ordinary settings file.

Every address the app contacts is https, and the list of them is published in PRIVACY.md. Nothing falls back to plain http: https://github.com/TheFleece/dota2-mod-manager/blob/main/PRIVACY.md

TLS is whatever Node and Electron negotiate, which is 1.2 at the oldest and 1.3 in practice. The app never lowers the default or disables a protocol check.

Certificate verification is the platform default and is never switched off. There is no rejectUnauthorized: false and no NODE_TLS_REJECT_UNAUTHORIZED anywhere in this repository.

The app sends no credential and no private information in a header at all. Where it does use TLS, verification is the default and is not disabled.

Every release carries SHA256SUMS and a Sigstore provenance attestation over that list, signed by the release workflow at the tagged commit, so gh attestation verify ties a downloaded file to a commit in this repository. The keys are Sigstore short-lived certificates rather than a private key sitting where the files are served. SECURITY.md documents the commands: https://github.com/TheFleece/dota2-mod-manager/blob/main/SECURITY.md

Everything from outside is checked before it is used: a name inside an archive is a name and never a path, foreign zips come through one reader that refuses traversal, links and sizes beyond their budget, catalog records are validated before they become library entries, and guide HTML goes through an allowlist of tags. docs/assurance-case.md walks each of them: https://github.com/TheFleece/dota2-mod-manager/blob/main/docs/assurance-case.md

The window runs with context isolation on, node integration off, and a content security policy that admits no remote script. The app asks for no elevation, downloads no code, and writes only in its own data folder and the game folder.

docs/assurance-case.md: what is being protected, the five trust boundaries and where each is enforced, the threats one at a time with what answers them, the secure design principles applied, and what the case does not claim. Every answer ends with the test that would fail if it stopped being true: https://github.com/TheFleece/dota2-mod-manager/blob/main/docs/assurance-case.md

CodeQL security queries for JavaScript and TypeScript.

The project own code is JavaScript. No C or C++ is written here.