We release patches for security vulnerabilities. Which versions are eligible for receiving such patches depends on the severity of the vulnerability:

We take the security of create-http-resources-slice seriously.

Please do not report security vulnerabilities through public GitHub issues.

Instead, please report them via email at security@example.com or create a private vulnerability report on GitHub.

Please include the following information in your report:

• Description of the vulnerability
• Steps to reproduce the issue
• Potential impact of the vulnerability
• Any suggested fixes (if applicable)

We will acknowledge receipt of your report within 48 hours and will send you a more detailed response within 5 business days indicating the next steps in handling your report.

Once a security issue is reported, we follow this process:

1. Investigation - We investigate the report and confirm the vulnerability
2. Fix Development - We develop a fix for the vulnerability
3. Testing - We test the fix thoroughly
4. Release - We release a patched version
5. Disclosure - We publicly disclose the vulnerability after users have had time to update

We aim to resolve critical security issues within 7 days of reporting.

When using create-http-resources-slice, please follow these security best practices:

Always validate data received from API endpoints before using it in your application.

try {
  const { data } = await fetchUsers();
  // Validate data before using
  if (Array.isArray(data)) {
    // Process data
  }
} catch (error) {
  // Handle error
}

Always use HTTPS for API endpoints to encrypt data in transit.

createHttpResources('user', {
  baseUrl: 'https://api.example.com' // ✅ Use HTTPS
});

Store tokens securely and never expose them in client-side code.

// ✅ Good: Use environment variables
createHttpResources('user', {
  fetchOptions: {
    headers: {
      'Authorization': `Bearer ${process.env.API_TOKEN}`
    }
  }
});

Cancel requests when components unmount to prevent memory leaks and unwanted state updates.

useEffect(() => {
  const { fetchUsers, cancelFetchUsers } = useStore();
  fetchUsers();
  
  return () => {
    cancelFetchUsers(); // Cleanup on unmount
  };
}, []);

Always implement proper error handling to prevent information leakage.

try {
  await postUser(userData);
} catch (error) {
  // Log error appropriately
  console.error('Failed to create user');
  // Don't expose internal error details to users
}

• This library does not perform input validation - validate data before sending to API
• This library does not handle authentication - implement auth in your API layer
• This library does not encrypt data - use HTTPS for all API calls

For security-related questions, please contact:

• Email: Contact via GitHub
• GitHub: @vyredo

Thank you for helping keep create-http-resources-slice and our users safe!