Security Policy

Supported Versions

We support the latest released minor version of each @better-i18n/* package.

Reporting a Vulnerability

Use GitHub Private Vulnerability Reporting on the affected repo: Security → Report a vulnerability. We respond within 3 business days.

Please do not open a public issue for security-sensitive reports.

Defense in Depth

Every public Better-i18n repo runs the shared Security baseline workflow (better-i18n/.github/.github/workflows/security-baseline.yml) on every pull request and on pushes to main / development:

• step-security/harden-runner (audit mode) — every outbound network call during the job is recorded. This is the tool that caught axios, tj-actions /changed-files (CVE-2025-30066), NX Build, Trivy v0.69.4, and Sha1-Hulud compromises in production CI runs.
• PolinRider / Shai-Hulud / TasksJacker IOC scan — fails the build if any known marker string (e.g. rmcej%otb%, Cot%3t=shtP, global['_V'], _$_1e42, function MDy, TRON/Aptos C2 strings) or known artifact filename (setup_bun.js, bun_environment.js, cloud.json, actionsSecrets.json, temp_auto_push.bat, discussion.yaml) lands in the working tree.
• SHA-pin enforcement — every GitHub Action reference must be a 40-char commit SHA, never a tag. Tag references can be retargeted to a malicious commit by the action owner (the tj-actions/changed-files / v1 retargeting is the textbook example).

Required Branch Protection

Maintainers must configure the following rules on each repo's default branch (main or development):

• Require a pull-request review with at least 1 approval from CODEOWNERS
• Require the Security baseline / Supply-chain baseline status check to pass
• Require conversation resolution before merging
• Require signed commits
• Require linear history
• Disallow force pushes and branch deletions

Acknowledgements

The supply-chain IOC list is sourced from OpenSourceMalware.com's #polinrider and #sha1hulud campaign reports.