Security posture

This page is the canonical statement of Thinwrap’s security posture. Per-package supply-chain provenance is independently verifiable on each package’s npm and Packagist listing.

Vulnerability disclosure

  • Email dev@thinwrap.dev or open a private security advisory in the affected package’s repository under github.com/thinwrap.
  • Acknowledge: within 48 hours.
  • Patch SLO: high / critical within 7 days; lower severities on a best-effort cadence.
  • Coordinated disclosure preferred. Reporters are credited in the fix changelog unless anonymity is requested.

Provenance

  • npm: every release is published with Sigstore provenance via GitHub Actions OIDC. The provenance badge is visible on each package’s npm page.
  • Packagist: each PHP release is cosign-signed as part of the tagged GitHub release Packagist syncs from.
  • PyPI: every release is uploaded through Trusted Publishing from GitHub Actions, and each file carries a PEP 740 attestation naming the workflow that built it.
  • Go modules: the git tag is the release. The public module proxy serves it, and sum.golang.org plus yourgo.sum verify its integrity.
  • Hex: Hex has no build-provenance attestation. The registry signs its index and your rebar.lock,mix.lock or Gleam manifest.toml pins each package’s checksum, which proves integrity, not where the package was built. Hex releases are published by the maintainer with 2FA until Hex opens CI publishing (workload identity, in beta) to the thinwrap organization.
  • Every npm, Packagist, PyPI and Go release is built in CI from the tagged commit — no manual upload path.

Supply-chain controls

  • No vendor SDKs. The TypeScript packages carry zero runtime dependencies (native fetch); the PHP packages depend only on the PSR-18/17 HTTP interfaces plus php-http/discovery — a bring-your-own client. The Go, Python and Erlang packages carry zero runtime dependencies too (net/http and urllib from the standard library, httpc from OTP).
  • OIDC publishing: no long-lived registry tokens in CI secrets. CI releases authenticate via short-lived federated tokens.
  • Branch protection on main: required status checks, code-owner review on release branches, no force-pushes.
  • Dev dependencies are pinned. Release CI verifies published provenance with npm audit signatures; the PHP pipeline runs composer audit.

Account security

  • 2FA enforced on every account with publish authority (GitHub, npm, Packagist, PyPI, Hex).
  • Publish authority is restricted to a named maintainer set; org membership reviewed quarterly.
  • No service accounts hold publish credentials.

Supported versions

Security fixes ship on the most recent minor of each package within the umbrella scopes:

  • @thinwrap/notifications · thinwrap/notifications · github.com/thinwrap/notifications-go · thinwrap-notifications · thinwrap_notifications
  • @thinwrap/location · thinwrap/location · github.com/thinwrap/location-go · thinwrap-location · thinwrap_location
  • @thinwrap/llm · thinwrap/llm · github.com/thinwrap/llm-go · thinwrap-llm · thinwrap_llm

thinwrap.dev itself is a live website (no version contract); fixes deploy via the next main push.

EU CRA positioning

Thinwrap is open-source software published without monetization, in line with the EU Cyber Resilience Act’s scope for open-source stewards. The posture above is documented to make third-party risk-evaluation review — including CRA-adjacent questionnaires — quick to answer.