@m8t-jacob/pln-utils has zero runtime dependencies. The nbp module makes outbound HTTPS requests to api.nbp.pl using the global fetch; all other modules (holidays, vat, format) perform no I/O and are pure functions. The attack surface is therefore limited to the NBP HTTP client and the calculation logic itself (e.g. a malicious input causing excessive CPU usage or a false result).

If you discover a security vulnerability, please do not open a public issue. Instead, report it privately via GitHub Security Advisories for this repository.

Please include:

• A description of the vulnerability and its potential impact
• Steps to reproduce (a minimal code sample is ideal)
• The package version affected

We aim to acknowledge reports within 5 business days and to release a fix as soon as reasonably possible.