Please do not open a public GitHub issue for a suspected security vulnerability. Instead, report it through the Expedy support portal, or through GitHub's private vulnerability reporting if enabled on this repository.

Include enough detail to reproduce the issue: affected version, environment, and a minimal example.

apiSid and apiToken (the Authorization: <SID>:<TOKEN> pair) are secrets:

• Store them in a secrets manager or environment variable — never in a client bundle or committed to source control.
• Rotate the token from the Expedy console if it has ever been logged, committed, or shared by accident.
• This repository, its docs/ and its examples/ never contain real credentials — everything is a placeholder (WP0RGS1SEDZ, MMAAZ112PI, environment variable references).

Releases are published from GitHub Actions with npm provenance — a signed attestation linking each published version to its source commit and build. Verify it with:

npm audit signatures

Only the latest published 1.x release is supported. Security fixes are released as a new patch or minor version — please upgrade rather than pinning to an old version.