Catherine Renelle
d418c367cb
Security fixes: - Validate theme background image URLs against whitelist pattern - Add board permission check to Socket.IO join-board handler - Disable raw HTML passthrough in markdown parser (XSS prevention) - Add UUID validation on avatar and branding route params (path traversal) - Add security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy) - Validate webhook URLs (HTTPS only, block internal addresses) - Add import payload size limit (5MB) - Remove server uptime from health endpoint - Make seed password configurable via SEED_ADMIN_PASSWORD env var - Patch DOMPurify dependency vulnerability via npm audit fix Warning fixes: - Convert $state(prop) to $effect.pre sync pattern (state_referenced_locally) - Add for/id pairings to form labels (a11y_label_has_associated_control) - Add svelte-ignore for intentional autofocus usage (a11y_autofocus) - Add ARIA roles to interactive/overlay divs (a11y_no_static_element_interactions) - Add aria-label to icon-only buttons (a11y_consider_explicit_label) - Add keyboard handler alongside click events (a11y_click_events_have_key_events) - Fix non-reactive fileInput declaration Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Pounce
An open source, self-hosted, multi-tenant kanban board.
Tech Stack
- Frontend: SvelteKit + Svelte 5 + Tailwind CSS v4
- Backend: SvelteKit API routes + Prisma ORM
- Database: PostgreSQL 16
- Real-time: Socket.IO
- Auth: Email/password with bcrypt + session cookies
- Deployment: Docker Compose + Portainer
Getting Started
Prerequisites
- Node.js 22+
- PostgreSQL 16+
Development
npm install
cp .env.example .env # edit DATABASE_URL as needed
npm run db:push # sync schema to database
npm run db:seed # seed default tenant + admin user
npm run dev
Docker
docker compose up
The app will be available at http://localhost:3000.
Default Credentials
- Email: admin@example.com
- Password: admin123
Multi-Tenancy
Pounce supports multiple tenants on a single instance. Each tenant is identified by hostname — map additional domains via the tenant_hostnames table.
License
MIT