Security is an essential pillar of Ranu.js. We take the safety and integrity of applications built on Ranu.js seriously and are committed to addressing vulnerabilities promptly and transparently.

Ranu.js is currently in active development (v0.1.x Public Alpha). Security boundaries and APIs evolve toward production stability, and we actively maintain and backport critical fixes to the latest published releases.

Security fixes and maintenance patches are applied exclusively to the latest published release on npm.

Please do not report security vulnerabilities through public GitHub issues, discussions, or social media.

Public disclosure leaves developers and production workloads vulnerable before a remedy can be deployed. We provide two private, coordinated channels:

1. Navigate to the Ranu.js Security Advisories dashboard.
2. Click "Report a vulnerability".
3. Fill in the advisory details, reproduction steps, and severity score.
4. Submit privately to the core maintenance team.

If you cannot access GitHub Private Vulnerability Reporting, or wish to include encrypted proof-of-concept material, send an email directly to:

✉️ security@hoslift.com

To help our security team investigate and remediate the issue efficiently, please include:

• Description: A concise explanation of the vulnerability and its potential impact.
• Affected Component: The specific package (e.g., @ranujs/core, create-ranujs, @ranujs/adapter-vercel) or runtime module.
• Reproduction Steps: Step-by-step instructions or a minimal proof-of-concept repository/script.
• Environment: Node.js version, operating system, and installed Ranu.js version (npx ranu -v).
• Threat Model Assessment: What an attacker could achieve (e.g., secret exfiltration, Denial of Service, path traversal).
• Mitigation Suggestions: Any suggested code fixes or temporary workarounds, if available.

We adhere to the following coordinated response schedule:

• Initial Acknowledgment: Within 72 hours of report receipt.
• Triage & Severity Confirmation: Within 7 days of acknowledgment.
• Remediation & Patch Deployment: Patches are prepared, tested, and released via private GitHub Advisories before public CVE issuance.
• Coordinated Disclosure: Release notes and researcher credits are published simultaneously with the patch release.

Ranu.js enforces specific architectural and compiler-level security guarantees:

1. server-only Compiler Boundary: Enforces compile-time isolation preventing server-only utilities, environment variables, or database credentials from leaking into client-side JavaScript bundles.
2. ReDoS (Regular Expression Denial of Service) Protection: Route matching and dynamic segment parsing operate within linear-time constraints to mitigate catastrophic backtracking.
3. Filesystem & Traversal Guard: Static asset streaming and route resolution strictly sanitize paths to block directory traversal attacks (../, %2e%2e) and sensitive dotfile exfiltration (.env, .git).
4. XSS & State Serialization Safety: Server-rendered stream payloads and hydrated state undergo strict escaping to neutralize script injection and prototype pollution vectors.
5. Request Header & Body Safety: Adapter boundaries enforce sensible default payload size ceilings to avoid memory exhaustion and DoS vectors.

We consider security research conducted in accordance with this policy to be authorized. We will not initiate legal action against researchers who:

• Make a good-faith effort to avoid privacy violations, data destruction, and service interruption.
• Give the maintainers reasonable time to remediate vulnerabilities before public disclosure.
• Do not exploit vulnerabilities beyond what is strictly necessary to establish proof-of-concept.

We deeply value the contributions of the security research community. If you report a confirmed, actionable vulnerability following this responsible disclosure policy, we will gladly:

• Credit your name or handle in the official GitHub Security Advisory.
• Acknowledge your contribution in the public release changelog (unless you prefer to remain anonymous).