Security policy

Stable UDIOT 1.0 has not shipped. Maintainers should evaluate security fixes against the newest reviewed release line; this document does not promise backports, a support duration, or a response SLA for older versions. The 1.x support window and response commitments must be approved before stable 1.0 publication.

Ownership

The sole project owner and security/support maintainer is @primeindian, confirmed by the owner on 2026-09-13. This GitHub profile identifies the maintainer; it is not a private vulnerability-reporting channel. On 2026-09-20 the owner designated harish@tagna.in as the private security-reporting contact.

Reporting

Do not publish exploit details, credentials, customer data, or production logs in public issues. Repository collaborators can contact the repository administrators through their established private project channel and request a restricted security discussion. Share only a minimal, redacted reproduction and affected versions.

Public npm users can email harish@tagna.in privately; source-repository access is not required. Include the affected package version, impact and a minimal redacted reproduction. Never include live credentials, customer records or unredacted production logs.

The owner has designated this address, but an external delivery/receipt test has not yet been recorded. Verify reachability with a nonsensitive message before stable 1.0 publication. Support windows and response commitments also remain pending; no response SLA is promised by this candidate.

Maintainer handling

Confirm affected versions and reproduction; assess exploitability and tenant/data impact; create a restricted remediation record; add a regression test; review the patch and fresh consumer audit; coordinate disclosure and patched release notes. Do not close a finding solely because a root lockfile audit is clean. Track independent consumer dependencies and accepted risks separately. Confirmed unresolved critical/high issues in the supported surface block stable release.

Maintainers with source-repository access can consult the internal branch audit in the website repository at archives/framework/docs/security/2026-09-12-branch-audit.md for tested boundaries and limitations. Automated audits and these tests are not an exhaustive penetration test or a guarantee of zero unknown vulnerabilities.

Deployment guidance

These settings are the application's responsibility; the framework cannot infer them.

• Trust proxy. Behind a load balancer or TLS-terminating proxy, set trustProxy on createWebServer() to the number of proxy hops (for example 1) or to the proxies' addresses. Without it, secure session cookies are never sent and req.ip is the proxy's address, so per-client rate limits apply to everyone at once. Avoid true unless every request passes through a proxy you control: it trusts X-Forwarded-For from any client, which lets callers choose the IP that rate limits and logs see.
• Session fixation. After a successful sign-in, call await regenerateSession(req) (from @tagna/udiot/server) before writing the user id to the session, then issue a fresh CSRF token with csrf.rotate(req). An id planted before sign-in is then useless. Do the same when privileges change, and destroy the session at sign-out.
• CSRF in single-page apps. Fetch the token from an endpoint guarded by csrf.token and send it in the X-CSRF-Token header on unsafe requests; keep it in memory and fetch it again after sign-in.
• Tenants. Tenant resolution is not authorization. Authenticate first; for signed-in users, put tenant_id in the verified token or pass authorizeTenant to tenantResolverMiddleware().

See server adapters and web applications for the full options.