Please report suspected vulnerabilities privately via GitHub Security Advisories: https://github.com/Nizoka/zipnative/security/advisories/new (Security → Report a vulnerability on the repository). Do not open a public issue for security reports. You should receive an acknowledgement within 48 hours and a fix or a documented mitigation within 7 days for a critical issue, 14 days otherwise; the advisory is published with the fix release and credits the reporter unless they prefer otherwise.

The latest published minor receives every fix; the previous minor (1.0.x) receives security fixes for six months after 1.1.0's publication, until 2027-04-08.

Packages are published from CI via npm Trusted Publishing (OIDC) with provenance attestations — verify with npm audit signatures. A CycloneDX SBOM is attached to every GitHub Release. Nobody publishes from a laptop (publishConfig.provenance makes a local npm publish fail).

Every workflow runs under step-security/harden-runner (egress audited), every action is pinned to a commit SHA (Dependabot owns the bumps), dependencies install with npm ci --ignore-scripts (.npmrc makes it the default locally too), pull requests pass dependency review with a licence allow-list, and a weekly npm audit runs on the lockfile. Publishing is three jobs with one artifact between them. verify holds no publishing token: it fetches the previous release tag, runs the full publish gate, packs the tarball once with its CycloneDX SBOM and a SHA256SUMS file, and hands them on. publish runs in the npm-publish environment behind a required reviewer, checks out .nvmrc and nothing else, verifies the tarball's digest against the job outputs, and publishes that file with a pinned npm through OIDC with provenance. attest downloads the same artifact, compares it byte for byte with what the registry serves, then generates SLSA Build L2 provenance for the published tarball and the SBOM (actions/attest-build-provenance) and attaches both to the GitHub Release. No release job restores a dependency cache; a workflow_dispatch dry run exercises everything up to npm publish --dry-run. Branch and tag rulesets are committed under .github/rulesets/. The engine itself has no runtime dependencies, so the published artefact's transitive closure is empty.

• The public API surface (docs/assets/api.json) is frozen: removals and behavioral breaks are semver-major.
• The 39-code error vocabulary (docs/data/errors.json) is frozen: removing or renaming a err.code is semver-major; additions are semver-minor.
• The deterministic: true output bytes are part of the contract: changing them is semver-major (ecosystem.json → deterministic_bytes_are_semver_major); since 1.1 the canonical bytes of canonicalizeZip() / saveCompact({ canonical: true }) are under the same contract.
• Minor releases are additive: 1.1.0 grew the public surface from 77 to 106 exports and removed none, every new behaviour is opt-in, and the byte baseline of the 33 pre-existing samples (npm run verify:samples) proves existing output unchanged; the compat-previous CI job runs the previous release's own test suite against every change. Each release note carries a compatibility ledger listing every observable change.

zipnative treats every archive as untrusted input. The engine is designed so that the default code path is the safe one.

ZIP is an attacker-friendly format: it is parsed from the end, tolerates leading and trailing garbage, duplicates its metadata (central directory vs local headers), and mixes 16/32/64-bit size fields. zipnative defends against:

The bounds themselves (ZipLimits, defaults in DEFAULT_ZIP_LIMITS, overridden per call with limits: { … }):

Every bound is named, documented on ZipLimits, and caller-configurable — raising a limit is always an explicit decision, never a silent default.

Every refusal above is thrown with a stable machine-readable error code (v0.8+, e.g. ZIP_PATH_TRAVERSAL, ZIP_ENTRY_OVERLAP, ZIP_LIMIT_EXCEEDED) — the frozen vocabulary lives in docs/data/errors.json and is documented in docs/guides/errors.md.

• Zero runtime dependencies — the supply chain is this repository.
• No eval, Function(), or dynamic code execution (enforced by ESLint).
• The engine never opens a socket and never touches the filesystem.
• No module-level side effects; all state lives in closure factories.
• CI runs CodeQL, OpenSSF Scorecard, npm audit, and an adversarial fuzzing suite (truncation, corruption, bombs, encoding tricks) on every push, on Linux, Windows and macOS.
• Every archive zipnative writes is validated clause by clause against ISO/IEC 21320-1:2015 by an engine-independent validator (npm run validate:zip), blocking in CI and before every publish — see the conformance guide. Conformance is not safety: hostile-but-spec-valid archives (zip-slip et al.) are exactly why the guards above exist.

• Encrypted archives are not supported (read or write) in 1.x. ZipCrypto is cryptographically broken; supporting it would create false confidence. Encrypted entries are detected and fail with a typed error whose feature names the scheme — 'zipcrypto', 'aes' (WinZip AES, labelled since 1.1, a 2.0 candidate) or 'strong-encryption'.
• removeEntry + incremental save() does not erase content (v0.4+): the append-only save model keeps original bytes verbatim, so removed entries remain recoverable from the file. saveCompact() is the true deletion path. This is documented loudly on the API.
• The forward streaming reader (iterateZipEntries) trusts local headers alone — there is no central directory to cross-check names, sizes or methods, so a hostile archive can present different content there than openZip() authoritatively reports (the upload-scanner differential, CWE-436 adjacent). All size limits are enforced by output counting and CRCs are verified, but treat forward-read metadata as unverified: use it only for streams you cannot seek, and never feed its names to a filesystem without sanitizeEntryPath().

Confirmed vulnerabilities are fixed in a patch release with a GitHub Security Advisory and a CHANGELOG entry crediting the reporter (unless anonymity is requested).