56 lines
1.1 KiB
Markdown
56 lines
1.1 KiB
Markdown
# Security Review
|
|
|
|
## Scope
|
|
|
|
Project:
|
|
|
|
```text
|
|
minecraft-renew-mod / create-limited-draining
|
|
```
|
|
|
|
Reviewed version or commit:
|
|
|
|
```text
|
|
Unreleased workspace state
|
|
```
|
|
|
|
## Code Patterns Checked
|
|
|
|
- [ ] No `eval`.
|
|
- [ ] No dynamic `Function` constructor.
|
|
- [ ] No unsafe HTML injection.
|
|
- [ ] No unexpected shell execution.
|
|
- [ ] No unexpected external network calls.
|
|
- [ ] No secrets committed.
|
|
- [ ] No unsafe file writes outside expected Gradle/Minecraft runtime paths.
|
|
|
|
## Dependency Review
|
|
|
|
Command:
|
|
|
|
```powershell
|
|
cd create-limited-draining
|
|
.\gradlew dependencies --configuration runtimeClasspath
|
|
```
|
|
|
|
Result:
|
|
|
|
```text
|
|
Completed successfully on 2026-05-15. Gradle resolved runtimeClasspath and reported the expected NeoForge, Create, Ponder, Flywheel, and Registrate dependency tree.
|
|
```
|
|
|
|
## Runtime Review
|
|
|
|
- [ ] Least-privilege runtime configuration.
|
|
- [ ] External dependency repositories documented in Gradle.
|
|
- [ ] Local Minecraft run data is ignored.
|
|
- [ ] Sensitive data is not persisted unless explicitly required.
|
|
|
|
## Release Notes
|
|
|
|
Known residual risks:
|
|
|
|
```text
|
|
In-game Hose Pulley behavior still needs manual world testing before publication.
|
|
```
|