Only the latest release of LugasJS receives security updates.

We take the security of LugasJS seriously. If you believe you have discovered a vulnerability:

1. Do not open a public issue.
2. Report the vulnerability privately via GitHub Security Advisories at https://github.com/ther12k/lugas/security/advisories/new or by contacting the project maintainers directly.
3. Include a detailed reproduction scenario, proof of concept, and affected version(s).

• Initial Response: Within 48 hours.
• Triage & Reproduction: Within 5 business days.
• Fix & Disclosure: Coordinated release and advisory published alongside the patch release.

LugasJS enforces:

• Redacted Error Policies: Framework internals, thrown error messages, and stack traces are redacted from HTTP responses in production mode.
• Validation Fail-Closed: Invalid request parameters, headers, and payloads fail with stable RFC 9457 Problem Details.
• Prototype Pollution Defense: Dictionaries created for normalized context employ null-prototype objects.
• No Unsafe Global Mutation: Route definitions and guard chains are deeply frozen at app preparation time.