+ A landing page can say a project is alive; a list of what landed says it + better. This is not a changelog — every release has notes, and they are on + the releases page. +
++ verdande is MIT licensed and provided as is, without warranty of + any kind. That sentence is in every MIT licence and it is usually + skipped, so here it is in the open: if you run this, you run it at your + own risk, and nobody is on the hook if it loses your work. +
++ It is one person's project, at version 0.x, and 0.x means the shape can + still change. You host it, so the data and the backups are + yours. It writes a backup every night and keeps fourteen — and a + backup nobody has ever restored is not yet a backup. Restore one before + you need to. +
++ Security is worked on rather than claimed. There have been two full + reviews of the code, every finding is written down and closed, and what is + protected and what is not is spelled out in + SECURITY.md + — including the parts that are a deliberate trade-off. Nobody + outside the project has audited it. The last review found two ways + to reach something you should not and closed both; a third review will find + more, which is the point of having one. +
++ It is built to sit behind something — a tunnel, a reverse proxy, a VPN — + put there by somebody who knows what they exposed. Found a hole? Mail it + rather than opening an issue; the address is in SECURITY.md and you get an + answer within a week. +
+