@assinafy/sdk 2.1.1 → 2.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/SECURITY.md CHANGED
@@ -44,8 +44,10 @@ opportunity to upgrade.
44
44
  authentication, and signer-access-code flows use an auth-free transport so
45
45
  configured account credentials are not sent to public endpoints.
46
46
  - Consumers must use HTTPS endpoints and protect all SDK configuration as
47
- secrets. Debug logging and error telemetry must be reviewed for response data
48
- before being enabled in production.
47
+ secrets. The client enforces this: a `baseUrl` using plaintext `http` is
48
+ rejected unless its host is loopback, so a credential cannot be sent in the
49
+ clear to a remote host. Debug logging and error telemetry must be reviewed
50
+ for response data before being enabled in production.
49
51
  - The webhook HMAC helper is an opt-in utility, not proof of an official
50
52
  Assinafy signing contract. Confirm the header, algorithm, encoding, and secret
51
53
  delivery mechanism with Assinafy before enforcing it. See