retrylens is pre-1.0. Only the latest published release receives security fixes.

Please do not open a public GitHub issue for security concerns.

Instead:

1. Open a private GitHub security advisory.
2. Include the affected version, a minimal reproducer, and any impact assessment.

You should get an acknowledgment within 7 days. A fix (or a decision that no fix is warranted with rationale) will follow, and a CVE will be requested if appropriate.

• retrylens's simulator is a pure function — it does not re-issue AWS requests, so running the preview against production traffic cannot amplify load or cause side-effects.
• The FailureInjector throws synthetic AwsServiceExceptions. It is intended for test scope only; misconfiguring it in production would cause your code to see failures that did not happen. Add the interceptor only in test builds or gate it behind an environment flag.
• The trace ring buffer is bounded and stores no request bodies, response bodies, headers, or credentials — only service name, operation name, HTTP status, exception class, and error code.