# StormFetch Security Policy

## Supported Versions

Security fixes are released on the latest published minor version. Upgrade to the newest `stormfetch` release before reporting behavior that may already be fixed.

## Reporting a Vulnerability

Please report suspected vulnerabilities privately to the maintainer listed in `package.json` and include:

- affected StormFetch version
- runtime and adapter (`fetch`, `xhr`, `http`, or `http2`)
- minimal reproduction
- whether credentials, proxy configuration, redirects, or private-network URLs are involved

Do not open public issues for active credential leaks, SSRF bypasses, header injection, redirect credential exposure, or package publishing compromise.

## Security Areas Covered

StormFetch treats the following as security-sensitive:

- SSRF and private-network access controls
- HTTP/HTTPS and host allow/block policies
- proxy and `NO_PROXY` handling
- redirect credential handling
- request signing and auth headers
- XSRF cookie-to-header behavior
- debug export redaction in history, curl, and HAR output
- package publishing provenance

## Release Process

Security releases should include:

- a patch or minor version bump
- `npm run typecheck`
- `npm run build`
- `npm pack --dry-run`
- updated API documentation when public behavior changes
- a short changelog entry in README or FEATURES
- the checks listed in `RELEASE_SECURITY.md`

## Publishing

The recommended npm publishing path uses GitHub Actions with OIDC trusted publishing and npm provenance. Avoid long-lived npm automation tokens when trusted publishing is available.

## Threat Model

See `THREATMODEL.md` for the supported threat model, high-risk flows, and explicit non-goals.