Vericto is a security product. We take vulnerabilities seriously and appreciate responsible disclosure.

Do not open a public GitHub issue for security vulnerabilities.

Report it privately, by either channel:

• Email security@vericto.com.
• Open a private report on GitHub: Report a vulnerability (Security tab → "Report a vulnerability"). Only the maintainers can see it.

Include:

• A description of the vulnerability and its impact.
• Steps to reproduce.
• The affected version (npm ls @vericto/sdk) and the driver involved.
• Any suggested remediation.

You will receive an acknowledgement within 48 hours and a status update within 5 business days.

High-priority issues for this package include:

• Credential exposure: the API key written, logged or sent anywhere other than the configured Vericto API over TLS.

• Guard bypass: a path through a wrapped connection that executes SQL Vericto did not evaluate, or blocked, outside an explicit failMode: 'open'; or a masked statement that runs the original SQL instead of rewrittenQuery.

• Data leakage to Vericto: bind values sent to the API.

• Supply chain: a published package that was not built by this repository's release workflow (every release carries npm provenance).

Issues in the SQL evaluation itself belong to vericto-engine.

1. Report received and acknowledged (within 48h).
2. We confirm and assess severity.
3. We develop and test a fix.
4. We release the fix and credit you (unless you prefer to remain anonymous).
5. Public disclosure after users have had reasonable time to update.

Security fixes are applied to the latest released version. Older versions are patched at the maintainers' discretion.

Thank you for helping keep Vericto and its users safe.