This is the vulnerability disclosure policy for @lgriffin/esi.ts. The controls the library and its build pipeline apply are described in guides/SECURITY.md. What the library claims, what it disclaims, who is trusted and how every report is classified are set out in the security model, guides/SECURITY-MODEL.md; read it before reporting, since a report outside the model is closed with the disposition it names.
| Version | Supported | Node.js |
|---|---|---|
| 12.x | Yes | 22.12 or later |
| 11.x | Security fixes until 2027-04-30 | 22.12 or later |
| 10.x | Security fixes until 2027-03-31 | 18 or later |
| 9.x | No | |
| 8.x | No | |
| 7.x | No |
The support window is described in guides/RELEASE.md.
Do not open a public GitHub issue for a security vulnerability.
- GitHub Security Advisories (preferred): report privately through Security Advisories.
- Email: contact the maintainer at the address listed on the GitHub profile.
Include:
- a clear description of the vulnerability
- steps to reproduce or a proof of concept
- the potential impact
- a suggested fix, if you have one
| Stage | Target |
|---|---|
| Acknowledgement | Within 48 hours of the report |
| Assessment | Severity and impact, after acknowledgement |
| Critical fix | Within 7 days |
| Non-critical fix | Next scheduled release |
Disclosure is coordinated with the reporter. Reporters are credited in the release notes unless they ask to remain anonymous.
| Category | Example |
|---|---|
| Credential exposure | Access tokens, refresh tokens or client secrets leaked in logs, URLs or error messages |
| Injection | Code, command or header injection through caller-supplied input |
| SSRF bypass | Reaching a host other than ESI without setting unsafeAllowCustomHost |
| Path traversal | Escaping the intended ESI route through a crafted path parameter |
| Dependency CVE | A known advisory in a runtime dependency that is exploitable in this context |
Typos, feature requests and ordinary bugs belong in GitHub Issues.
This policy covers the ESI.ts library and its release artefacts. Vulnerabilities in the EVE Online ESI API or EVE SSO themselves should be reported to CCP Games.
The in-scope vulnerability classes, the out-of-scope positions and the known non-findings are listed in guides/SECURITY-MODEL.md.