We take security vulnerabilities seriously. If you discover a security vulnerability in odesli.js, please follow these steps:

Security vulnerabilities should be reported privately to avoid potential exploitation.

Send a detailed report to: me@mtr.gg

• Description: A clear description of the vulnerability
• Steps to reproduce: Detailed steps to reproduce the issue
• Impact: Potential impact of the vulnerability
• Suggested fix: If you have suggestions for fixing the issue
• Affected versions: Which versions are affected
• Proof of concept: If applicable, include a proof of concept

• Initial response: Within 48 hours
• Status update: Within 1 week
• Fix timeline: Depends on severity and complexity

1. Keep dependencies updated: Regularly update to the latest version
2. Use HTTPS: Always use HTTPS when making API calls
3. Validate inputs: Validate all user inputs before passing to the library
4. Rate limiting: Respect API rate limits to avoid being blocked
5. API key security: Store API keys securely and never commit them to version control

1. Code review: All code changes require security review
2. Dependency scanning: Run npm audit before submitting PRs
3. Input validation: Always validate and sanitize inputs
4. Error handling: Don't expose sensitive information in error messages
5. Testing: Include security-focused tests

• URL validation and sanitization
• Parameter type checking
• Malformed response handling

• Safe error messages that don't expose internal details
• Graceful handling of malformed API responses
• Rate limiting error handling

• HTTPS-only communication
• API key validation
• Request parameter sanitization

We regularly audit our dependencies for security vulnerabilities:

# Check for vulnerabilities
npm audit

# Fix automatically fixable issues
npm audit fix

# Run security scan with Snyk
npm run security

When a security vulnerability is discovered:

1. Private disclosure: Issue is reported privately
2. Investigation: We investigate and validate the issue
3. Fix development: We develop and test a fix
4. Release: We release a patched version
5. Public disclosure: We publicly disclose the vulnerability with details

Security updates are released as patch versions (e.g., 1.0.1, 1.0.2) and should be applied immediately.

For security-related questions or concerns:

• Email: me@mtr.gg
• GitHub: @MattrAus

We appreciate security researchers and users who responsibly disclose vulnerabilities. Contributors to security improvements will be acknowledged in our release notes.