The site is a Cloudflare Worker, continuously deployed from main. Only the currently deployed version is supported; there are no released version branches.

Dependabot advisories against this repository are in the build and test toolchain rather than in what ships. turva-worker/package.json declares no runtime dependencies at all. Its only entry is wrangler, under devDependencies, so the deployed Worker bundles no third-party runtime code and no advisory against this repository reaches production. They are still cleared as they appear, because this repository is a reference implementation people fork. Checked 2026-08-16.

package.json also carries "overrides": { "esbuild": "0.28.1" }. wrangler pinned a vulnerable esbuild 0.27.3 at the time (GHSA-g7r4-m6w7-qqqr, an arbitrary file read in the development server on Windows, fixed in 0.28.1), and the override stays until wrangler's own dependency moves to at least 0.28.1 (Tek-16, 2026-06-14). A second advisory this paragraph used to cite beside it, GHSA-gv7w-rqvm-qjhr, was withdrawn by GitHub on 2026-06-17 and no longer carries the pin; the first one does on its own (corrected 2026-09-03).

If you discover a security vulnerability, please report it privately by emailing info@turva.dev.

Please do not open a public issue for security reports.

You can expect an initial response within a few days. If the issue is confirmed, a fix will be prioritized and you'll be kept informed of progress.