@m8t-jacob/inpost-shipx has zero runtime dependencies — it uses the global fetch available in Node.js 20+ (or an injected implementation via ShipXClientConfig.fetch) to call the InPost ShipX API (api-shipx-pl.easypack24.net / sandbox-api-shipx-pl.easypack24.net). The attack surface is therefore limited to: URL and query-string construction from user-supplied input (tracking numbers, point names, shipment ids, receiver/sender data), the Authorization: Bearer <token> header (the token is never logged, and never appears in a URL), and binary label handling (labels are returned as a raw ArrayBuffer, never parsed or executed).

If you discover a security vulnerability, please do not open a public issue. Instead, report it privately via GitHub Security Advisories for this repository.

Please include:

• A description of the vulnerability and its potential impact
• Steps to reproduce (a minimal code sample is ideal)
• The package version affected

We aim to acknowledge reports within 5 business days and to release a fix as soon as reasonably possible.