This security policy applies to all packages in the @libar-dev/zod-convex ecosystem:

• @libar-dev/zod-convex-core
• @libar-dev/zod-convex-ids
• @libar-dev/zod-convex-tables
• @libar-dev/zod-convex-codecs
• @libar-dev/zod-convex-gen
• @libar-dev/zod-convex-builders
• @libar-dev/eslint-plugin-zod-convex

We actively support the following versions with security updates:

Recommendation: Always use .strict() on Zod schemas to prevent data pollution:

// Secure: Rejects unexpected fields
export const UsersTableSchema = z.object({
  email: z.string().email(),
  name: z.string()
}).strict();

// Insecure: Allows arbitrary fields
export const UsersTableSchema = z.object({
  email: z.string().email(),
  name: z.string()
}); // Missing .strict()

Why: Without .strict(), external sources (AI providers, user input) can inject unexpected fields into your database.

The generator executes code in your schema files during build time:

Safe Usage:

• Run in CI/CD pipelines with trusted code
• Run locally on your own schema files
• Run in controlled build environments

Unsafe Usage:

• Running on schemas from untrusted sources
• Executing with elevated privileges unnecessarily
• Running in production environments

We recommend:

• Reviewing generated validators before first commit
• Using version control to track changes
• Running security scans on your complete codebase

When using authentication wrappers:

• Implement proper authentication logic in your getUser function
• Validate all user tokens against your authentication provider
• Use branded types for type-safe user IDs
• Never trust user-provided authentication claims

We take security vulnerabilities seriously. If you discover a security issue, please report it responsibly.

DO NOT create a public GitHub issue for security vulnerabilities.

Instead, please email us at: security@libar.ai

Include in your report:

1. Description: Clear description of the vulnerability
2. Impact: Potential impact and attack scenarios
3. Reproduction: Steps to reproduce the issue
4. Environment: Node.js version, package version, OS
5. Package: Which @libar-dev/zod-convex-* package is affected
6. Proposed Fix: If you have suggestions (optional)

After submitting a vulnerability report:

1. Acknowledgment: We will acknowledge receipt within 48 hours
2. Assessment: We will assess the vulnerability within 5 business days
3. Updates: We will keep you informed of our progress
4. Fix Timeline: Critical vulnerabilities will be patched within 7 days
5. Disclosure: We will coordinate public disclosure with you
6. Credit: We will credit you in the security advisory (if desired)

Security updates are released as patch versions and announced via:

• GitHub Security Advisories
• NPM advisory database
• Release notes in CHANGELOG.md
• GitHub Releases page

To receive security notifications:

1. Watch the GitHub repository
2. Enable Security Alerts in your repository settings
3. Monitor the GitHub Releases page

All packages in this ecosystem are monitored for vulnerabilities using:

• npm audit
• Dependabot alerts
• Manual security reviews

• zod: Schema validation library
• convex: Backend platform (peer dependency)

We actively monitor these dependencies and update promptly when security issues are discovered.

• Convex Security Best Practices
• Zod Documentation
• OWASP Top 10

For security-related questions:

• Email: security@libar.ai
• GitHub Issues: For non-security bugs only

Last Updated: 2025-01