This document outlines the security policy for the MovieBox JS SDK.

• Supported Versions
• Reporting a Vulnerability
• Security Best Practices
• Dependencies
• Security Updates

We recommend always using the latest version of the SDK to ensure you have the latest security patches.

If you discover a security vulnerability within this SDK, please send an email to the maintainer or open a GitHub issue with the label security.

When reporting a vulnerability, please include:

1. Description: A clear description of the vulnerability
2. Steps to Reproduce: Detailed steps to reproduce the issue
3. Impact: Potential impact of the vulnerability
4. Suggested Fix: If you have a suggestion for fixing the issue

• Initial Response: Within 48 hours
• Severity Assessment: Within 7 days
• Fix Timeline: Depending on severity (critical issues will be addressed immediately)

(To be determined)

// ❌ Don't hardcode sensitive data
const session = new MovieboxSession({
  proxyUrl: 'http://admin:password@proxy.com'
});

// ✅ Use environment variables
const session = new MovieboxSession({
  proxyUrl: process.env.MOVIEBOX_PROXY
});

// ❌ Don't use unsanitized user input
const detailPath = userInput; // Could be malicious

// ✅ Validate and sanitize input
const detailPath = sanitizePath(userInput);
if (!isValidPath(detailPath)) {
  throw new Error('Invalid path');
}

// ❌ Don't expose internal details
catch (error) {
  res.status(500).send(error.stack); // Exposes internals
}

// ✅ Return safe error messages
catch (error) {
  logger.error(error); // Log internally
  res.status(500).send('An error occurred'); // Safe message
}

Always use HTTPS for production connections:

const session = new MovieboxSession({
  protocol: 'https' // Default
});

When using proxies with authentication:

// Encode credentials properly
const proxyUrl = `http://${encodeURIComponent(username)}:${encodeURIComponent(password)}@proxy.com`;

const session = new MovieboxSession({
  proxyUrl
});

The SDK depends on the following packages:

We regularly scan dependencies for vulnerabilities using:

• GitHub Dependabot
• npm audit

1. Security issues are fixed as quickly as possible
2. We follow responsible disclosure practices
3. Security releases are prioritized and may bypass normal release cycles

Security updates are announced via:

• GitHub Security Advisories
• Release notes

To update to the latest version:

pnpm update moviebox-js-sdk

For security-related issues, please do NOT open a public issue. Instead:

1. Email the maintainer directly
2. Or use GitHub's private vulnerability reporting

Thank you to the following for helping improve the security of this project:

• (To be updated as contributors are acknowledged)

• Code of Conduct
• Contributing
• License