# StormFetch Security Denylist

StormFetch itself has no runtime dependency, so this denylist is used for release review and consumer guidance rather than runtime package blocking.

## Known Bad Package Versions

| Package | Versions | Action |
| --- | --- | --- |
| known-compromised-package | `example` | Treat as compromised; rotate secrets and reinstall from a clean lockfile |

## Review Rule

Before publishing, check newly introduced dev dependencies against:

- GitHub Security Advisories
- npm advisories
- vendor incident reports
- package provenance/signatures where available

Do not publish a release that adds a known-compromised package version to the build or release pipeline.