We take the security of zodkit seriously. If you have discovered a security vulnerability, please follow these steps:

1. DO NOT create a public GitHub issue for security vulnerabilities
2. Send a detailed report to the maintainers via:
   • GitHub Security Advisories (preferred)
   • Direct message to project maintainers

Please include the following information in your report:

• Description of the vulnerability
• Steps to reproduce the issue
• Potential impact
• Suggested fix (if available)
• Your contact information for follow-up

• Initial Response: Within 48 hours
• Status Update: Within 7 days
• Resolution Target: Within 30 days for critical issues

1. The reported issue will be confirmed and analyzed
2. A fix will be developed and tested
3. A security advisory will be prepared
4. The fix will be released as soon as possible
5. Credit will be given to the reporter (unless anonymity is requested)

When using zodkit in your projects:

1. Keep Dependencies Updated: Regularly update zodkit and its dependencies
2. Validate Configurations: Ensure your Zod schemas are properly configured
3. Limit File System Access: Be cautious with file patterns and paths
4. Review Generated Code: Always review any code generated by zodkit
5. Use Latest Stable Version: Avoid using pre-release versions in production

zodkit requires file system access to read and validate files. Ensure:

• File patterns are restricted to intended directories
• Sensitive files are excluded from validation
• Configuration files are properly secured

• Validate all user inputs before processing
• Use strict schema definitions
• Avoid dynamic schema generation from untrusted sources

zodkit relies on several third-party packages. We:

• Regularly audit dependencies for vulnerabilities
• Keep dependencies up-to-date
• Use npm audit in our CI/CD pipeline

zodkit includes several security features:

• Input Validation: All configurations are validated with Zod schemas
• Path Sanitization: File paths are sanitized before access
• No Code Execution: zodkit only analyzes code, never executes it
• Dependency Scanning: Regular security audits of dependencies

For any security concerns or questions, please contact the maintainers through GitHub.

We appreciate the security research community's efforts in helping keep zodkit and its users safe.