# Security policy

Security fixes are provided for the latest `@stackline/har-validator` release.
Use the private GitHub security advisory form at
https://github.com/alexandroit/stackline-har-validator/security/advisories/new
for suspected vulnerabilities. Do not include exploit details in a public
issue.

Reports should include the affected version, runtime, smallest reproducer, and
impact. Maintainers will acknowledge a report within five business days. No
unsupported security claim is made about `har-validator@5.1.5`; current clean
production installs already resolve a patched Ajv 6 line.

## Validation boundary

This package validates JavaScript values against the HAR 1.2 schemas. It does
not parse JSON, authenticate an archive, prove that an HTTP exchange occurred,
or make embedded content safe. Schema-valid URLs, headers, cookies, query
strings, post data, response text, and comments remain untrusted application
input.

Parse untrusted archives with explicit byte and nesting limits. Bound archive
entry count, individual strings and bodies, batch concurrency, total
validation work, and elapsed time before using this validator in a service.
The package reports all schema failures, so adversarial input can deliberately
increase error volume.

Validation does not enforce an origin allowlist, block internal-network URLs,
sanitize HTML or scripts, reconcile body sizes, or check timing consistency.
Apply those policies separately before fetching URLs, rendering content,
writing files, or recording security-sensitive analytics.

## Browser policy

Ajv 6 compiles schemas at runtime with `Function`. A strict Content Security
Policy may block that operation. Do not add `unsafe-eval` solely to make
validation work without assessing the resulting exposure; use a separately
reviewed precompiled validator design when dynamic code generation is outside
the application's policy.

Use normal root and deep imports with a browser-aware bundler when code needs
to compare failures with the exported `HARError`. The root-only standalone
entry deliberately does not expose the deep modules.

## Dependency and disclosure scope

Production dependencies are exact-pinned to Ajv 6.15.0 and har-schema 2.0.0;
the complete seven-component production and browser-bundle license inventory
is documented in [THIRD_PARTY_LICENSES.md](./THIRD_PARTY_LICENSES.md). Security
support applies to the latest scoped release, not to the unsupported upstream
package or arbitrary downstream bundles.