Only the latest minor release of each major version receives security fixes.

Once v1.0.0 is released, this table will be updated.

Please do not open a public GitHub issue for security vulnerabilities.

Report vulnerabilities privately via one of:

• GitHub Private Vulnerability Reporting (preferred): Navigate to the Security tab of this repository and click "Report a vulnerability".

• Email: Send details to me@akkil.dev.

• A description of the vulnerability and its potential impact.
• Steps to reproduce or a minimal proof-of-concept.
• The version(s) of Orqis affected.
• Any suggested mitigations or patches (optional but appreciated).

We will coordinate disclosure timing with you and credit you in the advisory unless you prefer to remain anonymous.

Orqis is a zero-dependency, in-process Node.js library with no network listeners, no file-system access, and no persistent state. The attack surface is limited to:

• Prototype pollution via task payloads.
• Denial-of-service via resource exhaustion (unbounded queue growth, CPU spin).
• Unexpected AbortController signal propagation.

Out of scope: vulnerabilities in your own task functions or in the broader Node.js runtime.

The following automated safeguards are in place across the repository:

• CodeQL Analysis — Static application security testing (SAST) runs on every push and pull request to detect vulnerabilities in source code.
• npm Audit — Dependency vulnerability scanning runs in CI, blocking critical-level issues from being merged.
• Dependabot — Automated pull requests are opened weekly to keep npm and GitHub Actions dependencies up to date with the latest security patches.

We follow Coordinated Vulnerability Disclosure (CVD). Patches will be released as a semver patch release accompanied by a GitHub Security Advisory and, where appropriate, a CVE.