We provide security updates for the following versions:

If you discover a security vulnerability in any Hilbras project, please do not open a public issue.

Instead, please report it responsibly:

1. GitHub Security Advisories (preferred): Use the "Report a vulnerability" button on the repo's Security tab
2. Email: Contact the maintainers directly via the org's discussion channel

• Which project and version is affected
• Steps to reproduce the vulnerability
• Potential impact assessment
• Any suggested fix (if you have one)

• Acknowledgment within 48 hours
• Assessment within 1 week
• Fix or mitigation for confirmed vulnerabilities will be prioritized

We appreciate responsible disclosure and will credit reporters (unless they prefer anonymity).

When using @hilbras/sdk:

• Never hardcode API keys — use environment variables or the CredentialProvider interface
• Use timeout on providers — prevents hung requests from consuming resources
• Enable circuit breakers — the default circuitBreakerEnabled: true prevents cascading failures
• Validate inputs — always validate tool call arguments before executing them
• Use prompt caching carefully — cached prompts may contain sensitive data on the provider's side