Only the latest released npm package and the latest main branch are supported.
Do not open public issues for secrets, auth bugs, or token leaks.
Email:
security@dhruvmars.com
Include:
- what happened
- repro steps
- impact
- logs or screenshots if safe
You will get an acknowledgement as soon as possible. Fixes will be released privately first when needed, then disclosed publicly after patching.