Security Policy

Supported Versions

We actively maintain and provide security updates for the following versions:

Version	Supported
1.7.x	✅
1.6.x	❌
1.5.x	❌
1.2.x	❌
1.1.x	❌
1.0.x	❌

Older versions are no longer supported and will not receive security updates.

Reporting a Vulnerability

To report a security vulnerability, please use the GitHub Security Advisory by clicking the "Report a Vulnerability" button in the Security tab of this repository.

Do not open a public issue to report vulnerabilities, as this may expose sensitive information.

What to Include in Your Report:

When submitting a vulnerability report through the GitHub Security Advisory, please include the following information:

1. Vulnerability Description:
   A clear and concise explanation of the vulnerability, including the potential impact (e.g., data leakage, unauthorized access, etc.).

2. Steps to Reproduce:
   Detailed, step-by-step instructions to reproduce the issue. Include code snippets, configurations, or any prerequisites required.

3. Affected Versions:
   Specify the version(s) of the package where the issue occurs. If possible, confirm whether the issue exists in the latest release.

4. Environment Details:
   Information about your environment, such as:

   • Operating System (e.g., Windows 10, macOS Monterey)
   • Node.js version
   • Package version

5. Proof of Concept (PoC):
   A minimal, working example that demonstrates the vulnerability (if possible).

6. Suggested Fix (Optional):
   If you have ideas or suggestions for resolving the issue, please include them.

7. Additional Context (Optional):
   Any other relevant information that may help us understand the issue better (e.g., logs, related issues, references).

We will review your report promptly and coordinate with you to address the issue.

---

Security Fix Process

1. We will acknowledge receipt of your report within 72 hours.
2. We will investigate, confirm, and develop a fix.
3. A patch will be released, and the version will be updated accordingly.
4. Credit will be given to the reporter unless anonymity is requested.

Disclosure Policy

• We follow a responsible disclosure policy: vulnerabilities will be disclosed publicly after a fix has been released.
• Users will be notified of critical issues via release notes.

---