Please do not open a public GitHub issue for security vulnerabilities.

Send a report to privacy@syvel.io with:

• A description of the vulnerability and its potential impact
• Steps to reproduce or a proof of concept
• Affected package(s) and version(s)

We will acknowledge your report within 48 hours and aim to release a fix within 14 days for critical issues.

We ask that you give us reasonable time to address the issue before any public disclosure.

This policy covers:

• syvel-js — JavaScript/TypeScript SDK
• syvel-python — Python SDK
• n8n-nodes-syvel — n8n community node
• The Syvel REST API (api.syvel.io)

• Rate limiting or quota bypass on free-tier accounts
• Issues in third-party dependencies (please report upstream)
• Social engineering attacks