# Security and Dependency Review

This document records the security checks required before publishing `@schedulespark/rrule`.

## Current Dependency Model

The package has no runtime dependencies.

Development dependencies are limited to TypeScript and Vitest.

The package does not perform network requests, execute user-provided code, store secrets, or render HTML.

## Required Checks Before First Publish

Run from the repository root:

```bash
pnpm audit --prod
pnpm --filter @schedulespark/rrule pack --dry-run
```

Review the dry-run package contents for accidental source maps, local environment files, generated secrets, test fixtures with private data, or unrelated monorepo files.

Expected package contents are constrained by `files` in `package.json`:

- `dist`
- `README.md`
- `LICENSE`
- `CHANGELOG.md`
- `docs`

## Manual Review Checklist

- No `.env`, credentials, service tokens, or private URLs in the packed package.
- No bundled app-specific ScheduleSpark business logic in the package.
- No runtime dependency without a license and maintenance review.
- Date parsing and expansion do not evaluate user-provided code.
- Unsupported RRULE fields do not trigger unsafe fallback behavior.

## First Publish Decision

For this SCH-45 readiness pass:

- `pnpm audit --prod` reported no known vulnerabilities.
- `pnpm --filter @schedulespark/rrule pack --dry-run` included only the expected package metadata, `dist`, README, license, changelog, and package docs.

The `Security Review Required` Linear label can be cleared after the maintainer confirms the exact release commit and version.