feat:add terms of service and privacy policy - #154
Conversation
|
Warning Review limit reached
Next review available in: 45 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
WalkthroughOrgExplorer now includes Privacy Policy and Terms of Service documents. Footer links point to the hosted Markdown files. External footer links open in a new tab with ChangesPolicy and Footer Integration
Estimated code review effort: 2 (Simple) | ~10 minutes Poem
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
no-issue-linked
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@privacy-policy.md`:
- Around line 93-99: Update the Markdown code block around the “Your Browser”
diagram by adding a blank line before the fence and specifying the text language
on the opening fence, while preserving the diagram content and closing fence.
- Around line 115-132: Update the GitHub Personal Access Token disclosure to
clarify that the saved copy remains in browser localStorage while authenticated
requests send the token to GitHub’s API, rather than claiming it never leaves
the device. Document the XSS risk of persistent localStorage storage, recommend
avoiding persistence when possible, and state that persistent tokens must use
minimum scopes and remain revocable.
In `@terms-of-service.md`:
- Line 210: Ensure terms-of-service.md ends with exactly one trailing newline
after the final sentence, without changing any other content.
- Line 163: Correct the Privacy Policy Markdown link in the referenced
terms-of-service content by removing the stray quote from the URL before the
closing parenthesis, while preserving the link text and destination.
- Around line 192-196: Update Section 10, “Governing Law and Dispute
Resolution,” to name the legally approved governing law and specify the intended
dispute venue or arbitration forum. Replace the current AOSSIE
operational-jurisdiction wording and informal-communication-only process, using
the exact terms confirmed through legal review.
- Around line 111-113: Update the contributor guidance or pull-request workflow
to include the same perpetual, irrevocable, non-exclusive, worldwide license
grant for code, documentation, and other contributions under the repository’s
open-source license, ensuring contributors see and acknowledge these terms
before submitting changes; keep the existing terms-of-service language
consistent.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 1fb6873b-f401-48a3-9b4d-19c27fb93255
📒 Files selected for processing (3)
privacy-policy.mdsrc/components/layout/Footer.jsxterms-of-service.md
| ``` | ||
| Your Browser | ||
| | | ||
| | | ||
| v | ||
| GitHub API (api.github.com) | ||
| ``` |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Fix the Markdown code fence.
Add a blank line before the fence and specify a language such as text. This resolves MD031 and MD040.
Proposed Markdown fix
The only external communication occurs directly between:
-```
+```text
Your Browser
|
|
v
GitHub API (api.github.com)</details>
<details>
<summary>🧰 Tools</summary>
<details>
<summary>🪛 markdownlint-cli2 (0.23.2)</summary>
[warning] 93-93: Fenced code blocks should be surrounded by blank lines
(MD031, blanks-around-fences)
---
[warning] 93-93: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
</details>
</details>
<details>
<summary>🤖 Prompt for AI Agents</summary>
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @privacy-policy.md around lines 93 - 99, Update the Markdown code block
around the “Your Browser” diagram by adding a blank line before the fence and
specifying the text language on the opening fence, while preserving the diagram
content and closing fence.
</details>
<!-- fingerprinting:phantom:poseidon:caracal -->
<!-- cr-indicator-types:potential_issue -->
<!-- cr-comment:v1:819215c018eea40b55e853fa -->
_Source: Linters/SAST tools_
<!-- This is an auto-generated comment by CodeRabbit -->
| ### GitHub Personal Access Token | ||
|
|
||
| If you choose to provide a GitHub Personal Access Token: | ||
|
|
||
| - It is stored only in your browser's `localStorage` | ||
| - It is sent only to GitHub's API | ||
| - It is never logged by OrgExplorer | ||
| - It is never transmitted to OrgExplorer servers | ||
|
|
||
| ### Token Safety Recommendations | ||
|
|
||
| We recommend: | ||
|
|
||
| - Using a token with the minimum permissions required | ||
| - Avoiding unnecessary scopes | ||
| - Revoking your token from GitHub settings if you suspect misuse | ||
|
|
||
| Please note that browser `localStorage` is not encrypted. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
if [ -f privacy-policy.md ]; then
echo "== privacy-policy.md line count =="
wc -l privacy-policy.md
echo "== relevant lines =="
nl -ba privacy-policy.md | sed -n '1,155p'
else
echo "privacy-policy.md not found"
fd -i 'privacy.*policy.*md'
fi
echo "== search for token/localStorage references =="
rg -n "Personal Access Token|localStorage|localStorage|GitHub|tokens|token" privacy-policy.md . --glob '!node_modules' --glob '!dist' --glob '!build' | head -n 200Repository: AOSSIE-Org/OrgExplorer
Length of output: 278
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== privacy-policy.md line count =="
wc -l privacy-policy.md
echo "== relevant lines =="
awk '{printf "%5d\t%s\n", NR, $0}' privacy-policy.md | sed -n '1,155p'
echo "== search for token/localStorage references =="
python3 - <<'PY'
from pathlib import Path
patterns = ["Personal Access Token", "localStorage", "GitHub API", "never leaves", "minimum permissions"]
file = Path("privacy-policy.md")
lines = file.read_text().splitlines()
for i, line in enumerate(lines, start=1):
if any(p.lower() in line.lower() for p in patterns):
print(f"{i}: {line}")
all_files = [p for p in Path(".").rglob("*") if p.is_file()]
terms = ["localStorage", "Personal Access Token", "github", "GitHub", "token"]
hits = []
for p in all_files:
if "node_modules" in p.parts or "dist" in p.parts or "build" in p.parts:
continue
try:
s = p.read_text(errors="ignore").splitlines()
except Exception:
continue
for i, line in enumerate(s, start=1):
if any(t.lower() in line.lower() for t in terms):
hits.append((p, i, line[:160]))
hits = hits[:200]
for h in hits:
print(f"{h[0]}:{h[1]}: {h[2]}")
print(f"total hits={len(hits)}")
PYRepository: AOSSIE-Org/OrgExplorer
Length of output: 22928
Correct the Personal Access Token storage disclosure.
The summary at lines 45-56 says this list never leaves the device, but the Personal Access Token is sent to GitHub’s API. State that the saved copy remains in browser storage while authenticated requests send the token to GitHub. Also note the XSS exposure from persistent localStorage storage for sensitive tokens, and avoid persistent token storage if possible. If persistence is required, document that risk and require a minimum-scope, revocable token.
🧰 Tools
🪛 LanguageTool
[style] ~120-~120: This adverb was used twice in the sentence. Consider removing one of them or replacing them with a synonym.
Context: ...r browser's localStorage - It is sent only to GitHub's API - It is never logged by...
(ADVERB_REPETITION_PREMIUM)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@privacy-policy.md` around lines 115 - 132, Update the GitHub Personal Access
Token disclosure to clarify that the saved copy remains in browser localStorage
while authenticated requests send the token to GitHub’s API, rather than
claiming it never leaves the device. Document the XSS risk of persistent
localStorage storage, recommend avoiding persistence when possible, and state
that persistent tokens must use minimum scopes and remain revocable.
Source: MCP tools
| ## 10. Governing Law and Dispute Resolution | ||
|
|
||
| This Agreement is governed by applicable law in the jurisdiction where the maintaining organization, AOSSIE, primarily operates. | ||
|
|
||
| In case of disputes, the parties agree to first attempt resolution through informal communication before pursuing other remedies. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Repository files matching terms-of-service:'"
fd -a 'terms-of-service\.md$' . || true
echo
echo "Relevant excerpt:"
if [ -f terms-of-service.md ]; then
nl -ba terms-of-service.md | sed -n '170,210p'
fi
echo
echo "Search for AOSSIE and governing law references:"
rg -n -i 'AOSSIE|governing law|jurisdiction|dispute resolution|forum|venue|governed by' .Repository: AOSSIE-Org/OrgExplorer
Length of output: 304
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Relevant excerpt:"
awk 'NR>=170 && NR<=210 {printf "%4d\t%s\n", NR, $0}' terms-of-service.md
echo
echo "Search for AOSSIE and governing law references:"
grep -RInEi 'AOSSIE|governing law|jurisdiction|dispute resolution|forum|venue|governed by' .Repository: AOSSIE-Org/OrgExplorer
Length of output: 50379
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Relevant excerpt:"
awk 'NR>=170 && NR<=210 {printf "%4d\t%s\n", NR, $0}' terms-of-service.md
echo
echo "Governing law references from terms-of-service.md:"
grep -n -iE '10\. Governing Law|governing law|jurisdiction|dispute resolution|forum|venue|governed by|arbitration|courts' terms-of-service.md || true
echo
echo "Restricted AOSSIE references from tracked text files only:"
git ls-files -z | xargs -0 grep -n -i 'AOSSIE|organization|maintaining organization' | head -n 80 || trueRepository: AOSSIE-Org/OrgExplorer
Length of output: 2201
Name the governing law and the dispute forum.
Section 10 still refers to AOSSIE’s operational jurisdiction and informal communication only. Replace this with a specific governing law and the intended venue or arbitration forum after legal review.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@terms-of-service.md` around lines 192 - 196, Update Section 10, “Governing
Law and Dispute Resolution,” to name the legally approved governing law and
specify the intended dispute venue or arbitration forum. Replace the current
AOSSIE operational-jurisdiction wording and informal-communication-only process,
using the exact terms confirmed through legal review.
|
|
||
| --- | ||
|
|
||
| *These Terms are provided for transparency around an open-source project and are not a substitute for professional legal advice.* No newline at end of file |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Add the required final newline.
The file must end with exactly one newline to satisfy MD047.
🧰 Tools
🪛 markdownlint-cli2 (0.23.2)
[warning] 210-210: Files should end with a single newline character
(MD047, single-trailing-newline)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@terms-of-service.md` at line 210, Ensure terms-of-service.md ends with
exactly one trailing newline after the final sentence, without changing any
other content.
Source: Linters/SAST tools
github-actions
Bot
added
size/L
|
|
||
| OrgExplorer is open-source software. Its source code, license terms, and contribution guidelines are available at [the project's GitHub repository](https://github.com/AOSSIE-Org/OrgExplorer). | ||
|
|
||
| Your rights to use, modify, and redistribute the underlying code are governed by that repository's license. This Agreement additionally governs your use of the *deployed, hosted instance* of the Project available at [Live Demo](https://orgexplorer.aossie.org/). |
There was a problem hiding this comment.
Change "Live Demo" to the link itself.
This is not a demo. This is ready in-production version.
|
|
||
| --- | ||
|
|
||
| ## 6. Contributions and Community Conduct |
There was a problem hiding this comment.
Remove this section. It is not part of a terms of service.
|
|
||
| If you have questions regarding these Terms of Service, contact us: | ||
|
|
||
| **Email:** [aossie.oss@gmail.com](mailto:aossie.oss@gmail.com) |
| ## 11. Contact Information | ||
|
|
||
| If you have questions regarding these Terms of Service, contact us: | ||
|
|
There was a problem hiding this comment.
Include a link to our discord as well.
| @@ -0,0 +1,212 @@ | |||
| # Terms of Service | |||
There was a problem hiding this comment.
This looks very good overall. I suggest giving it to a powerful LLM for further improvement.
2 participants
Addressed Issues:
Fixes #(issue number)
Additional Notes:
Added legal documentation pages for OrgExplorer, including:
Terms of Service
Privacy Policy
Implemented them using Markdown-based content rendering for easier maintenance and future updates. Added proper footer links and ensured external references and contact information are handled correctly.
This improves transparency around data handling, GitHub API usage, and user responsibilities.
Checklist
We encourage contributors to use AI tools responsibly when creating Pull Requests. While AI can be a valuable aid, it is essential to ensure that your contributions meet the task requirements, build successfully, include relevant tests, and pass all linters. Submissions that do not meet these standards may be closed without warning to maintain the quality and integrity of the project. Please take the time to understand the changes you are proposing and their impact.
Summary by CodeRabbit
Documentation
Improvements