ts-platform

Every package's CHANGELOG.md documents every version's changes (including behavior fixes like ADR-007's skipAuth precedence change, with a link to the full rationale) — that serves as the upgrade path between versions. SECURITY.md is explicit that only the latest release is supported, and upgrading is a documented, low-friction dependency bump given the changes are called out per version. https://github.com/codeminity/ts-platform/blob/main/packages/request/axios/CHANGELOG.md

GitHub Issues is used for tracking individual issues. https://github.com/codeminity/ts-platform/issues

No vulnerabilities have been resolved in the last 12 months (no reports received yet).

SECURITY.md documents the reporting channel (private email) and a committed response time (48–72 hours). https://github.com/codeminity/ts-platform/blob/main/SECURITY.md#reporting-a-vulnerability

CONTRIBUTING.md's "Code Style" section documents the style rules, backed by eslint.config.ts (typescript-eslint strictTypeChecked/stylisticTypeChecked) and Prettier. https://github.com/codeminity/ts-platform/blob/main/CONTRIBUTING.md#code-style

ESLint and Prettier (both FLOSS) automatically enforce the style — via a pre-commit hook (Husky + lint-staged) and again as a required CI check (pnpm lint) on every PR. https://github.com/codeminity/ts-platform/blob/main/eslint.config.ts

No native binaries are produced (pure TypeScript/JavaScript, compiled via tsc/esbuild).

A typical JS/TS library build — no "install -s"-style stripping flag exists; sourcemaps/declaration maps are generated by default via tsconfig.base.json.

Turborepo's task graph topologically sorts packages by their actual dependency edges (e.g. request-core before axios/fetch) and builds each package exactly once — not naive recursive-make. https://github.com/codeminity/ts-platform/blob/main/turbo.json

Verified directly: built the repo twice from a clean state and diffed SHA-256 checksums of every file under each package's dist/ — bit-for-bit identical output both times.

Standard npm ecosystem convention: pnpm add @codeminity/axios / npm install / yarn add to install, pnpm remove / npm uninstall to uninstall. https://github.com/codeminity/ts-platform/blob/main/packages/request/axios/README.md#installation

No POSIX-style installation system exists — packages install via the standard npm registry mechanism, not a DESTDIR-style file copy.

CONTRIBUTING.md's "Development Setup" section documents the standard clone-and-install path (git clone, corepack enable, pnpm install, pnpm test), which also wires up the git hooks automatically. https://github.com/codeminity/ts-platform/blob/main/CONTRIBUTING.md#development-setup

Dependencies are listed in a machine-readable form in each package's package.json and locked in pnpm-lock.yaml. https://github.com/codeminity/ts-platform/blob/main/pnpm-lock.yaml

GitHub's Dependabot vulnerability alerts are enabled on the repo (continuously checked against the GitHub Advisory Database), alongside Socket.dev and Renovate scanning on every push/PR. https://github.com/codeminity/ts-platform/blob/main/SECURITY.md#continuous-scanning

Dependencies are standard npm packages declared in package.json; Renovate opens an automatic update PR per outdated/vulnerable dependency, grouped by minor/patch, so updating is a routine PR review, not manual archaeology. https://github.com/codeminity/ts-platform/blob/main/SECURITY.md#continuous-scanning

Renovate keeps dependencies at their latest compatible versions on a weekly cadence, and TypeScript's strict compiler mode surfaces deprecated API usage in the project's own code. https://github.com/codeminity/ts-platform/blob/main/SECURITY.md#continuous-scanning

CI (ci.yml) runs pnpm test on every push and pull request, producing a pass/fail GitHub Actions check. https://github.com/codeminity/ts-platform/blob/main/.github/workflows/ci.yml

Sampled the last 6 months of "fix:" commits: 6 of 8 real behavior fixes (75%) added or modified a test file alongside the fix, comfortably above the 50% threshold. https://github.com/codeminity/ts-platform/commits/main

Vitest (FLOSS) enforces a 100% statement coverage threshold in CI — well above the 80% requirement. https://github.com/codeminity/ts-platform/blob/main/vitest.config.ts

CONTRIBUTING.md's "Testing Rules" section documents the policy, and it's not just written but mechanically enforced: CI's 100% coverage threshold in vitest.config.ts blocks any PR that adds functionality without tests. https://github.com/codeminity/ts-platform/blob/main/CONTRIBUTING.md#testing-rules

CONTRIBUTING.md, the project's instructions for change proposals, documents the test policy directly in its "Testing Rules" section. https://github.com/codeminity/ts-platform/blob/main/CONTRIBUTING.md#testing-rules

TypeScript strict mode is enabled with additional stricter flags (noUncheckedIndexedAccess, exactOptionalPropertyTypes, noUnusedLocals/Parameters), and ESLint uses typescript-eslint's strictest presets (strictTypeChecked, stylisticTypeChecked). https://github.com/codeminity/ts-platform/blob/main/tsconfig.base.json

Secure design principles are concretely applied: least privilege via short-lived OIDC tokens instead of a long-lived NPM_TOKEN, defense in depth (CodeQL + Socket.dev + Scorecard + Dependabot alerts layered independently), and explicit control flow / no hidden global state as stated project-wide (see ARCHITECTURE.md's state rule). https://github.com/codeminity/ts-platform/blob/main/SECURITY.md#release--supply-chain-security

The library doesn't implement any cryptographic algorithms itself (its only crypto.* usage is crypto.randomUUID() for request IDs, not security-relevant).

The library never persists authentication credentials or private keys to files — tokens are supplied by the consuming application at runtime via a callback/config and attached to request headers; there is no credential storage layer of any kind.

The library only ever communicates via native fetch or axios, which exclusively use HTTP(S) — it has no protocol implementation of its own and never uses or exposes insecure legacy protocols (FTP, telnet, SSHv1). Secure protocol support (TLS/HTTPS) comes from the underlying platform. Beyond that, the library actively detects misconfiguration: warnIfInsecureUrl (@codeminity/request-core) logs a warning whenever an Authorization header or COOKIE-mode credential is about to be sent over a non-HTTPS, non-loopback origin, so an accidental http:// baseURL doesn't silently leak credentials. https://github.com/codeminity/ts-platform/blob/main/packages/request/core/src/auth/warn-insecure-url.ts

TLS version negotiation is entirely delegated to the underlying platform (browser fetch / Node's https stack), which defaults to TLS 1.2+ (Node 24 supports up to TLS 1.3).

Verified: no code anywhere in the repo sets rejectUnauthorized: false, NODE_TLS_REJECT_UNAUTHORIZED, or any other certificate-verification bypass — TLS certificate verification runs at its platform default (enabled) for every request.

Same platform-default TLS handling applies uniformly to every request the library makes, including ones carrying Authorization headers or cookies — certificate verification happens before any request (and its headers) is sent.

npm packages are cryptographically signed via npm provenance (Sigstore-based, keyless — no private key exists anywhere, let alone on a distribution site), documented in SECURITY.md with the verification command (npm audit signatures). https://github.com/codeminity/ts-platform/blob/main/SECURITY.md#release--supply-chain-security

Untrusted network-derived values the library interprets (HTTP status codes, error names/codes) are matched against an exhaustive known-value map with a safe "unknown" fallback for anything else — an allowlist pattern, not free-form parsing. Verified no eval, new Function, or prototype-pollution-prone code exists anywhere in the codebase. https://github.com/codeminity/ts-platform/blob/main/packages/request/fetch/src/errors/outcome-to-event.ts

TypeScript strict mode (plus noUncheckedIndexedAccess, exactOptionalPropertyTypes) catches whole classes of defects at compile time; ESLint's strictTypeChecked preset forbids unsafe patterns; verified no eval, new Function, or prototype manipulation exists anywhere in the codebase. https://github.com/codeminity/ts-platform/blob/main/tsconfig.base.json

ASSURANCE_CASE.md documents the threat model, trust boundaries, applied secure design principles, and how common implementation weaknesses (injection, prototype pollution, type confusion, credential leakage, insecure TLS defaults, supply-chain compromise, unsafe concurrency) are countered — each claim backed by a concrete, verifiable fact in the codebase. https://github.com/codeminity/ts-platform/blob/main/ASSURANCE_CASE.md

CodeQL's default query suite includes security-focused rules (CWE-based) for common vulnerability classes in JavaScript/TypeScript. https://github.com/codeminity/ts-platform/blob/main/.github/workflows/codeql.yml

The project is written entirely in TypeScript/JavaScript, a memory-safe language; no C/C++ or other memory-unsafe code is produced.