Security

SECURITY.md

Security Policy

Supported Versions

Version	Supported
0.4.x	Yes
< 0.4	No

Reporting a Vulnerability

If you discover a security vulnerability, please report it responsibly:

Do not open a public issue
Email the maintainers or use GitHub Security Advisories
Include a description of the vulnerability and steps to reproduce

We will acknowledge receipt within 48 hours and provide a fix timeline.

Security Measures

All user-controlled values in SQL queries use parameterized queries (Drizzle sql tagged template)
JSON path segments validated with assertSafeIdentifier to prevent injection via sql.raw
No eval, no dynamic require, no user-controlled code execution

There aren't any published security advisories