We take security issues seriously. Thank you for helping to make this project more secure.

Please DO NOT open a public GitHub issue for security vulnerabilities.

Instead, please use one of these methods:

1. GitHub Security Advisories (preferred): Use the "Report a vulnerability" button on the Security tab of this repository.
2. Email: Send details to the repository maintainer via their GitHub profile.

• Description of the vulnerability
• Steps to reproduce
• Affected versions
• Potential impact
• Suggested fix (if you have one)

• Acknowledgment: Within 48 hours
• Initial assessment: Within 1 week
• Fix target: Within 30 days for critical issues

• We follow coordinated disclosure
• Please do not publicly disclose the vulnerability until a fix is available
• We will credit reporters in the security advisory (unless anonymity is requested)

This package:

• Has zero runtime dependencies (only n8n-workflow as peer dependency)
• Makes HTTP requests only to public Brazilian data APIs (BrasilAPI, ViaCEP, OpenCEP, ApiCEP, ReceitaWS, CNPJ.ws, MinhaReceita, OpenCNPJ.org, OpenCNPJ.com, CNPJA, BancosBrasileiros, Nager.Date, parallelum, IBGE API, BCB/Câmbio, BCB/Taxas)
• Does not store or cache any data
• Does not require authentication credentials
• Runs within the n8n sandbox with standard node permissions

Every release is published with npm provenance, which cryptographically links the published package to its source code and build process via Sigstore.

# Verify provenance of installed package
npm audit signatures

You can also view provenance on the npm package page — look for the "Provenance" section.

Each release build generates a provenance attestation via actions/attest-build-provenance, providing a tamper-proof record of what source code and build process produced the release artifacts. Attestations are stored in the GitHub repository and can be verified via the GitHub UI or CLI.

For a detailed threat model, trust boundaries, and security design analysis, see SECURITY-ASSESSMENT.md.

• Always use the latest version of this package
• Use package-lock.json to pin dependency versions
• Enable Dependabot or Renovate for automated security updates
• Run npm audit signatures to verify package provenance