The ZikoJS project takes security issues seriously. We welcome responsible reports of vulnerabilities affecting ZikoJS packages, documentation, build tooling, or other project-maintained software.
Security fixes are primarily provided for the latest supported release of each actively maintained package.
Because ZikoJS is a multi-package ecosystem and releases may occur independently, support can vary between packages.
| Version | Supported |
|---|---|
| Latest stable release | ✅ |
| Previous major release | ❌ |
| Pre-release versions | Best effort |
| Unsupported releases | ❌ |
Pre-release versions, including beta releases, may contain unresolved security issues and are not guaranteed to receive security fixes.
Users are encouraged to upgrade to the latest available release before reporting an issue that may already have been fixed.
If you believe you have found a security vulnerability in ZikoJS, please report it privately rather than opening a public GitHub issue.
Use the GitHub Security Advisories feature for the affected repository when available.
When reporting a vulnerability, please include:
- The affected package and version.
- A description of the vulnerability.
- The potential security impact.
- Steps to reproduce the issue.
- A minimal proof of concept when possible.
- Any relevant configuration or environment information.
- A suggested mitigation or fix, if you have one.
Please do not include passwords, access tokens, private keys, personal information, or other sensitive data in a report.
After receiving a security report, maintainers will:
- Review the report and determine whether it affects a ZikoJS project.
- Attempt to reproduce and assess the reported vulnerability.
- Keep the report private while it is being investigated.
- Determine the affected versions and severity.
- Develop or coordinate a fix when appropriate.
- Release a security update when a fix is available.
- Publish an appropriate security advisory when necessary.
We will make reasonable efforts to acknowledge security reports and provide updates during the investigation.
Response and remediation times depend on the severity, complexity, and scope of the vulnerability.
Please allow maintainers reasonable time to investigate and address a vulner