Report a vulnerability in private. Do not open a public issue.
crypto, jwt, oauth2, webhooks, and wire handle secrets and signatures. Several packages load native libraries (OpenSSL, libsqlite3, libz, libzstd, brotli). Proofs do not cover the .c and .js effects.
The latest version of each package on the Bend hub. Older versions are not patched. A publish is permanent.