Only the latest published version of each @siteping/* package receives security updates.

Do not open a public issue for security vulnerabilities.

Instead, please report vulnerabilities through one of these channels:

1. GitHub Security Advisories (preferred) -- Report a vulnerability
2. Email -- Send details to security@neosianexus.dev

• Description of the vulnerability
• Steps to reproduce
• Affected package(s) and version(s)
• Potential impact

• We follow coordinated disclosure.
• We will credit reporters in the release notes (unless you prefer to remain anonymous).
• We ask that you do not publicly disclose the vulnerability until a fix has been released.

This policy applies to all packages in the @siteping/* scope:

• @siteping/widget
• @siteping/adapter-prisma
• @siteping/adapter-memory
• @siteping/adapter-localstorage
• @siteping/cli

• apiKey is required in production. Starting createSitepingHandler({ prisma }) with NODE_ENV=production and no apiKey throws at startup. Destructive endpoints (DELETE, PATCH) refuse to operate without authentication unless you explicitly opt out via requireAuthForDestructive: false (only safe behind your own auth middleware).
• Set allowedOrigins. Without it, no CORS headers are emitted and cross-origin browser requests are blocked. With allowedOrigins: ["https://your-site.com"], only listed origins can call the API.
• Rate-limit POST. The widget submits from unauthenticated browser contexts. Apply rate limiting at the reverse proxy or middleware layer (Next.js middleware, Nginx, Cloudflare).
• Run the CLI doctor. npx @siteping/cli doctor flags missing apiKey, missing allowedOrigins, and other production red flags.