Please report suspected vulnerabilities privately via GitHub Security Advisories (Security → Report a vulnerability on the repository). Do not open a public issue for security reports. You should receive an initial response within 7 days.

Only the latest published minor version receives security fixes.

Packages are published from CI via npm Trusted Publishing (OIDC) with provenance attestations — verify with npm audit signatures. A CycloneDX SBOM is attached to every GitHub Release. Nobody publishes from a laptop (publishConfig.provenance makes a local npm publish fail).

• The public API surface (docs/assets/api.json) is frozen: removals and behavioral breaks are semver-major.
• The 39-code error vocabulary (docs/data/errors.json) is frozen: removing or renaming a err.code is semver-major; additions are semver-minor.
• The deterministic: true output bytes are part of the contract: changing them is semver-major (ecosystem.json → deterministic_bytes_are_semver_major).

zipnative treats every archive as untrusted input. The engine is designed so that the default code path is the safe one.

ZIP is an attacker-friendly format: it is parsed from the end, tolerates leading and trailing garbage, duplicates its metadata (central directory vs local headers), and mixes 16/32/64-bit size fields. zipnative defends against:

Every bound is named, documented on ZipLimits, and caller-configurable — raising a limit is always an explicit decision, never a silent default.

Every refusal above is thrown with a stable machine-readable error code (v0.8+, e.g. ZIP_PATH_TRAVERSAL, ZIP_ENTRY_OVERLAP, ZIP_LIMIT_EXCEEDED) — the frozen vocabulary lives in docs/data/errors.json and is documented in docs/guides/errors.md.

• Zero runtime dependencies — the supply chain is this repository.
• No eval, Function(), or dynamic code execution (enforced by ESLint).
• The engine never opens a socket and never touches the filesystem.
• No module-level side effects; all state lives in closure factories.
• CI runs CodeQL, OpenSSF Scorecard, npm audit, and an adversarial fuzzing suite (truncation, corruption, bombs, encoding tricks) on every push, on Linux and Windows.
• Every archive zipnative writes is validated clause by clause against ISO/IEC 21320-1:2015 by an engine-independent validator (npm run validate:zip), blocking in CI and before every publish — see the conformance guide. Conformance is not safety: hostile-but-spec-valid archives (zip-slip et al.) are exactly why the guards above exist.

• Encrypted archives are not supported (read or write) in 1.x. ZipCrypto is cryptographically broken; supporting it would create false confidence. Encrypted entries are detected and fail with a typed error.
• removeEntry + incremental save() does not erase content (v0.4+): the append-only save model keeps original bytes verbatim, so removed entries remain recoverable from the file. saveCompact() is the true deletion path. This is documented loudly on the API.
• The forward streaming reader (iterateZipEntries) trusts local headers alone — there is no central directory to cross-check names, sizes or methods, so a hostile archive can present different content there than openZip() authoritatively reports (the upload-scanner differential, CWE-436 adjacent). All size limits are enforced by output counting and CRCs are verified, but treat forward-read metadata as unverified: use it only for streams you cannot seek, and never feed its names to a filesystem without sanitizeEntryPath().

Confirmed vulnerabilities are fixed in a patch release with a GitHub Security Advisory and a CHANGELOG entry crediting the reporter (unless anonymity is requested).