1.5 KiB
Security policy
Report suspected vulnerabilities privately to security@sandwichhime.com.
Include the affected package/version, a minimal reproduction, impact, and any
suggested mitigation. Please do not place secrets, personal request logs, live
databases, or exploit details in a public issue.
The maintainer aims to acknowledge reports within three business days, provide an initial triage within seven, and keep reporters updated at least every fourteen days while work remains open. These are best-effort targets, not a service-level agreement. There is no bug bounty.
The preview supports only versions explicitly listed in release notes. Security claims stop at the documented trust boundaries and executable tests.
Password recovery is an explicitly local administrative capability. It must
not be wired directly to a public route. Applications using it are responsible
for local operator authorization and exclusive mode-0600 credential delivery;
the library transaction requires a new password change, revokes all sessions,
and records a secret-free audit event.
Passkey recovery is also local-only. Applications must not expose bootstrap or
recovery issuance as a public route. Enrollment tokens are single-use,
short-lived, digest-backed values and their plaintext belongs only in an
exclusive mode-0600 delivery file. A passkey assertion proves control of a
credential; applications must still bind sensitive actions to exact server-side
state and authorize the resulting principal.