The current alpha line of dsh-einvoice is supported for security reports. Older alpha builds are not supported.

Please do not open a public issue for a vulnerability. Email novelnexusai@outlook.com with:

• the package and version,
• a minimal reproduction,
• the impact you believe it has.

This is a public/synthetic alpha project. It has no bug bounty, no SLA, and no customer data. Reports are handled on a best-effort basis; a fix or a written “not affected / won't fix” answer will be recorded in the repository.

In scope: the published npm package, its Cordis patch, local file handling, and the documented tool surface. Out of scope: findings that require customer data, a modified package, or a service this project does not ship.