sently is a messaging library that holds provider API keys and tokens in the installing application at runtime. Treat compromised publishes and credential leaks as high severity.
Do not open a public GitHub issue for security reports.
Use GitHub Security Advisories for this repository so the report stays private until a fix is ready.
Include:
- Affected package version(s)
- Impact (credential exfiltration, unauthorized send, SSRF, signature bypass, …)
- Reproduction steps or a minimal proof of concept when possible
| Stage | Target |
|---|---|
| Initial acknowledgement | Within 72 hours |
| Triage (severity / severity) | Within 7 days of acknowledgement |
| Fix or mitigation guidance | As soon as practical; critical issues are prioritized over feature work |
These are goals, not SLAs. Complex issues may take longer; we will keep the reporter updated.
After 1.0.0, security fixes land on the current 1.x line (latest minor/patch). See the stability policy for what is semver-frozen.
| Version | Security patches |
|---|---|
1.x |
Yes |
0.x |
Best effort only (pre-1.0; prefer upgrading to 1.x) |
npm publishes from CI (.github/workflows/publish.yml) use:
npm publish --provenance— attestations linking the tarball to this public repository and the build- Trusted Publishing (OIDC) — preferred path so a long-lived
NPM_TOKENis not required
On npmjs.com/package/sently → Settings → Trusted Publisher:
- Bind GitHub Actions
- Repository:
omqkhafi/sently - Workflow:
publish.yml(.github/workflows/publish.yml) - Environment:
production(must match the workflowenvironment) - Confirm the npm package repository URL matches
package.json→repository
Until one OIDC publish has succeeded, CI may fall back to a repository secret NPM_TOKEN / NODE_AUTH_TOKEN if present. Remove that secret after OIDC is verified.
- Web Push endpoint allowlisting / SSRF checks
- Redaction of push endpoints and FCM tokens in hooks
- Webhook signature verification helpers for Supported providers