# Security and safe-use boundary

Report suspected vulnerabilities privately through the GitHub security
advisory form for `alexandroit/stackline-fstream`. Do not disclose an unfixed
vulnerability in a public issue.

Include the affected version, Node.js version, operating system and filesystem,
a minimal reproduction, expected and actual events, path/link layout, impact,
and any suggested mitigation.

## Supported line

The latest `1.x` release is supported on Node.js 14.15.1 and newer.

## Production dependency statement

The only production dependency is exact-pinned `graceful-fs@4.2.11`. The old
`inherits`, `mkdirp`, and `rimraf` production paths are absent.

[GHSA-xf7w-r453-m56c](https://github.com/advisories/GHSA-xf7w-r453-m56c)
affects upstream `fstream` versions below `1.0.12`. This continuation derives
from the patched `1.0.12` baseline; a clean `1.0.12` install must not be
represented as affected by that historical range.

## Filesystem trust boundary

This library performs caller-directed filesystem operations:

- Writers can create or replace files, directories, and links and apply modes,
  ownership, and timestamps where permissions allow.
- Incompatible destinations are clobbered by default.
- `follow: true` may traverse a symbolic link outside the lexical source tree.
- Filters receive filesystem-derived metadata but do not create a sandbox.
- Filesystem changes are not transactional and may be partially complete when
  an error occurs.

Callers must validate source and destination paths, enforce an allowed root,
decide whether link following and clobbering are acceptable, constrain
permissions, and avoid applying untrusted ownership or metadata.

Ancestor-cycle detection bounds recursive traversal. It does not prevent a
non-cyclic external target and is not a containment mechanism.

## Archive inputs

Do not use fstream as an archive extraction policy. Before passing archive
entries to a Writer, reject absolute paths, traversal segments, unsafe links,
special files, and resource-exhaustion inputs according to the caller's trust
model.

## Availability

Large or deep trees, unusual devices, and adversarial filesystems can consume
time, file descriptors, memory, or disk. Apply application-level size, depth,
entry-count, timeout, and cancellation limits when input is not trusted.

The package has no browser security model or browser build.