@hyper.authio/server 0.10.0 → 0.11.0

package/README.md

@@ -73,8 +73,8 @@ const verifier = createAuthioVerifier({
 Nothing tells a lightweight token apart from a full one that carries no role (a person without roles has no
 `*_resource_access` either), so the verifier never guesses: the mode decides. The introspection answer is cached per
 `jti` for `introspectionCacheDuration`, so `activeCheck` asks Authio once per token and cache period. The answer only
-adds claims: one the token carries keeps the token's value, which its signature vouches for (Authio answers a single
-`aud`, and `client_id` for `azp`).
+adds claims: one the token carries keeps the token's value, which its signature vouches for, whatever the answer says
+(it names `client_id` for `azp`).
 
 ### Protected resource metadata (RFC 9728)
 
@@ -204,6 +204,16 @@ const billing = createOnBehalfOf({ client: authioClient, resource: "https://bill
 await billing.fetch(user)("https://billing.example.com/invoices"); // exchanged once, cached, retried once on 401
 ```
 
+## Security
+
+Report a vulnerability privately, by email to **security@hyperio.tech**, and not in an issue or anywhere else in
+public. Authio's [vulnerability disclosure policy](https://authio.hyperio.tech/docs/trust/vulnerability-disclosure)
+says what is in scope and what happens after a report. Only the latest published minor receives security fixes.
+Questions and bugs that are not about security go to [support](https://authio.hyperio.tech/docs/account/support).
+
+Em português: relate vulnerabilidades em sigilo, pelo e-mail **security@hyperio.tech**, e nunca numa issue nem em outro
+lugar público. A política está no link acima.
+
 ## License
 
 MIT