We release patches for security vulnerabilities in the following versions:

Please do not report security vulnerabilities through public GitHub issues.

If you discover a security vulnerability in BabelFHIR-TS, please send an email to the maintainer with:

• Subject: [SECURITY] Brief description of the issue
• Description: Detailed description of the vulnerability
• Steps to reproduce: How to reproduce the issue
• Impact: What could an attacker accomplish
• Proposed fix: If you have suggestions

You can report security issues to:

• Create a private security advisory on GitHub
• Or contact the maintainer directly through the repository

• Acknowledgement: Within 48 hours
• Initial assessment: Within 5 business days
• Regular updates: As we work on a fix
• Public disclosure: After a fix is released (coordinated with reporter)

When we receive a security report, we will:

1. Confirm the problem and determine affected versions
2. Audit code to find similar problems
3. Prepare fixes for all supported versions
4. Release patched versions
5. Publish a security advisory

• Generated TypeScript interfaces provide compile-time type safety but not runtime validation without the validator functions
• Always call .validate() on resources from untrusted sources
• The generated validators perform FHIRPath checks but don't cover all FHIR conformance rules
• Consider using the official HL7 FHIR Validator for production conformance testing

We regularly update dependencies to address known vulnerabilities. Run npm audit to check for issues in your installation.

• BabelFHIR-TS executes code generation based on FHIR StructureDefinitions
• Only process StructureDefinitions from trusted sources
• Be cautious when generating code from untrusted FHIR packages

1. Validate inputs: Always validate FHIR resources from external sources
2. Review generated code: Inspect generated TypeScript before using in production
3. Keep updated: Regularly update to the latest version
4. Use TypeScript strict mode: Enable strict type checking in your project
5. Test thoroughly: Write tests for your FHIR resource handling code

See the README's Limitations section for current known limitations that may have security implications.

Thank you for helping keep BabelFHIR-TS and its users safe!