@hyper.authio/client 0.10.0 → 0.11.0

package/README.md

@@ -250,6 +250,16 @@ camelCase with its value unchanged; `event.data` stays as delivered (snake_case)
 The signature is HMAC-SHA256 of `{t}.{body}`, compared in constant time; the timestamp must be within 5 minutes.
 [`@hyper.authio/server`](../server/README.md) adds deduplication and dispatch.
 
+## Security
+
+Report a vulnerability privately, by email to **security@hyperio.tech**, and not in an issue or anywhere else in
+public. Authio's [vulnerability disclosure policy](https://authio.hyperio.tech/docs/trust/vulnerability-disclosure)
+says what is in scope and what happens after a report. Only the latest published minor receives security fixes.
+Questions and bugs that are not about security go to [support](https://authio.hyperio.tech/docs/account/support).
+
+Em português: relate vulnerabilidades em sigilo, pelo e-mail **security@hyperio.tech**, e nunca numa issue nem em outro
+lugar público. A política está no link acima.
+
 ## License
 
 MIT

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hyper.authio/client",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Authio client for Node.js and edge runtimes: discovery, interactive sign-in with ID tokens and logout, every grant, JWE, introspection, client-credentials cache, Admin API credentials, roles and permissions, webhooks.",
   "license": "MIT",
   "type": "module",
@@ -46,6 +46,9 @@
     "url": "git+https://github.com/LeonardoFerreira1209/authio-node.git",
     "directory": "packages/client"
   },
+  "bugs": {
+    "url": "https://authio.hyperio.tech/docs/account/support"
+  },
   "publishConfig": {
     "access": "public"
   }