Security fixes are provided for the latest published minor release of Open Local Audit.
Report vulnerabilities privately through GitHub Security Advisories.
Do not include vulnerability details, proof-of-concept payloads, secrets, or affected customer data in public issues.
Maintainers will acknowledge a valid report as soon as practical, investigate impact, and coordinate remediation and disclosure with the reporter.
Open Local Audit audits public websites and writes local reports. Most commands require no secrets or accounts. The optional Google Places provider reads GOOGLE_MAPS_API_KEY from the local environment and must not write it to reports, logs, examples, or repository files.
Features that store remote customer data, send messages, manage accounts, or sync external systems require a security review before release.
If npm audit reports a transitive dependency issue from an old open-local-audit install, upgrade to the latest release:
npm install open-local-audit@latestVersions before the current release may keep older transitive dependency locks in consuming projects. Re-run npm audit after upgrading the package and refreshing the consuming project's lockfile.