dgf1988/codewhale

Files

T

Hunter Bown a3acdbe70b docs(brand): rename to codewhale across READMEs and docs

Sweep brand mentions of `DeepSeek TUI` / `deepseek-tui` / bare
`deepseek` (the dispatcher binary) across all user-facing docs to
the new `codewhale` brand. The DeepSeek **provider** integration is
left untouched throughout: env vars (`DEEPSEEK_*`), model IDs
(`deepseek-v4-pro`, `deepseek-v4-flash`, `deepseek-chat`,
`deepseek-reasoner`), the `api.deepseek.com` host, the
`~/.deepseek/` config dir, and the `--provider deepseek` argument
value all keep the legacy spelling.

Anti-scope items deliberately left as the legacy `deepseek-tui`:

- Homebrew tap and formula (`Hmbown/homebrew-deepseek-tui`,
  `brew install deepseek-tui`, `scoop install deepseek-tui`). The
  tap rename ships separately.
- Docker image (`ghcr.io/hmbown/deepseek-tui`). Image-tag rename
  ships separately.
- CNB mirror namespace (`cnb.cool/deepseek-tui.com/DeepSeek-TUI`).
  Third-party hosted path.
- Security contact email (`security@deepseek-tui.com`).
- GitHub repo URL (`Hmbown/DeepSeek-TUI`).

New artifact:

- `docs/REBRAND.md` documents what changed, what didn't, the
  deprecation window, and migration commands for npm / Cargo /
  Homebrew / manual installs.

CHANGELOG entries:

- Root `CHANGELOG.md` and `crates/tui/CHANGELOG.md` both gain a
  new `[Unreleased]` section describing the rename and the one-
  release deprecation window. Historical entries are untouched.

Issue templates:

- `.github/ISSUE_TEMPLATE/bug_report.md` and `feature_request.md`
  refer to "codewhale" / `codewhale --version` instead of the old
  brand name in their environment fields.

The rebrand sweep was driven by a perl script with bulk patterns
(`deepseek-tui` -> `codewhale-tui`, `DeepSeek TUI` -> `codewhale`,
bare `deepseek` -> `codewhale` with provider/model/host/env-var/
config-path negative lookbehind/lookahead) followed by targeted
reverts for the anti-scope items above. Output was visually
reviewed file-by-file before committing.

Verified:

- `cargo check --workspace --all-targets --locked` — pass.
- `cargo test --workspace --all-features --locked` — pass (no
  test source touched here; suite stayed green to confirm no
  doc-from-string assertions broke).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-23 11:25:48 -05:00

2.7 KiB

Raw Blame History

Security Policy

codewhale is a coding agent with direct access to file operations, shell execution, and the network. Security disclosures are taken seriously.

Supported Versions

Only the latest stable release receives security patches. No backports to older versions.

Version	Supported
latest stable	✅
< latest	❌

Check the releases page for the current version.

Reporting a Vulnerability

Do not open a public GitHub issue for security vulnerabilities.

Report privately via one of:

GitHub private advisory: github.com/Hmbown/DeepSeek-TUI/security/advisories/new
Email: security@deepseek-tui.com — include [SECURITY] in the subject line

Include in your report:

A description of the vulnerability and the impact if exploited
Steps to reproduce or a proof of concept
Affected versions and configuration details
Any suggested mitigation (optional)

Response Timeline

Phase	Target
Acknowledgment	Within 48 hours of receipt
Assessment	Within 5 days — triage severity, scope, and fix approach
Patch (critical)	Within 14 days from assessment
Patch (moderate/low)	Next feature release or per-maintainer timeline
Disclosure	After patch is shipped and users have had time to update

You will receive status updates at each phase. If the timeline slips, we will communicate the reason and the revised estimate.

Scope

In scope (what counts)

Remote code execution through crafted prompts or model responses
Sandbox escape — breaking out of the YOLO-mode workspace boundary or shell cwd confinement
Credential leak — exfiltration of API keys, tokens, or environment secrets
Arbitrary file read/write outside the intended workspace (PathEscape bypass)
SSRF via fetch_url or web_search against internal network endpoints
Unauthorised MCP server access or tool invocation

Out of scope

Social engineering of the maintainer or contributors
Denial of service / rate-limit exhaustion against the DeepSeek API
Vulnerabilities in third-party dependencies (report to the upstream project)
Attacks requiring physical access to the victim's machine
Theoretical ML-model injection attacks not demonstrated in the codewhale context

If you are unsure whether a bug is in scope, report it anyway. We will triage and respond.

Hall of Fame

We maintain a hall of fame for reporters who submit verified security vulnerabilities. To be credited, include your preferred name / handle in the report.

No entries yet — be the first.

2.7 KiB Raw Blame History