Do not open GitHub issues for security vulnerabilities.

If you discover a security vulnerability in micro-requester, please report it responsibly by emailing:

📧 iimuhammad.rashed@gmail.com

Include:

• Type of vulnerability
• Location in code (file, function, line)
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

We'll acknowledge your report within 48 hours and work with you on a fix.

✅ Keep dependencies up-to-date ✅ Run security audits (npm audit) ✅ Follow secure coding practices ✅ Respond promptly to reported vulnerabilities ✅ Document security considerations

❌ Don't use micro-requester for sensitive data without TLS ❌ Don't hardcode credentials in client config ❌ Don't ignore SSL/TLS certificate errors

• undici — Maintained by Node.js core team, actively audited

We monitor:

• npm audit — Run on every PR and release
• Dependabot — Automatic dependency updates
• GitHub Security Alerts — Real-time notifications

Security updates are released immediately. Patch versions (0.x.Z) are reserved for security fixes.

Correlation IDs help identify malicious requests:

const client = createClient({
  service: 'api',
  base: 'https://api.example.com',
  getReqId: () => requestContext.getStore()?.requestId,
});

Always set appropriate timeouts:

const client = createClient({
  service: 'api',
  base: 'https://api.example.com',
  timeoutMs: 5000,  // 5 second timeout
});

Sensitive headers are automatically sanitized in logs:

// Authorization headers, cookies, API keys are NOT logged
const client = createClient({
  logger: { info: console.log },
  defaultHeaders: {
    Authorization: 'Bearer token...',  // Safe - not logged
  },
});

Always use HTTPS in production:

// ❌ Development only
const devClient = createClient({
  base: 'http://localhost:3001',
});

// ✅ Production
const prodClient = createClient({
  base: 'https://api.example.com',
});

Don't expose sensitive error details to clients:

try {
  const user = await client.get(`/users/${id}`);
} catch (error) {
  // ✅ Safe - don't expose internal errors
  logger.error('User fetch failed', {
    userId: id,
    statusCode: (error as any).statusCode,
  });
  
  // ❌ Unsafe - exposes internals
  res.status(500).json(error);
}

micro-requester@0.1.0 is a new release. No known vulnerabilities.

• Security Issues: iimuhammad.rashed@gmail.com
• General Questions: GitHub Issues
• Discussions: GitHub Discussions

Thank you for helping keep micro-requester secure. 🔒