@assinafy/sdk 2.1.2 → 2.3.0

package/SECURITY.md

@@ -44,8 +44,23 @@ opportunity to upgrade.
   authentication, and signer-access-code flows use an auth-free transport so
   configured account credentials are not sent to public endpoints.
 - Consumers must use HTTPS endpoints and protect all SDK configuration as
-  secrets. Debug logging and error telemetry must be reviewed for response data
-  before being enabled in production.
+  secrets. The client enforces this: a `baseUrl` using plaintext `http` is
+  rejected unless its host is loopback, so a credential cannot be sent in the
+  clear to a remote host. Debug logging and error telemetry must be reviewed
+  for response data before being enabled in production.
+- An OAuth `client_secret` belongs only on a server you control: never in
+  browser code, a mobile application, or a repository. A public application has
+  no secret and authenticates with PKCE alone. The SDK sends the token and
+  revocation requests on the credential-free transport, so a workspace
+  `X-Api-Key` is never attached to a route that authenticates the application.
+- Treat OAuth refresh tokens as single-use. Each refresh returns a new one and
+  retires the old one, and replaying a retired token ends the whole connection
+  for that user. Persist the new value before acting on the response, and never
+  refresh one connection concurrently.
+- Authorization responses are validated before they are trusted: `state` is
+  compared in constant time and `iss` must match the expected issuer. Do not
+  bypass `readAuthorizationCallback()` and exchange a code straight from the
+  query string.
 - The webhook HMAC helper is an opt-in utility, not proof of an official
   Assinafy signing contract. Confirm the header, algorithm, encoding, and secret
   delivery mechanism with Assinafy before enforcing it. See