@m8t-jacob/polish-registry has a single runtime dependency, @m8t-jacob/validate, used to validate NIP checksums before any network request is made. The whitelist and vies modules make outbound HTTPS requests to wl-api.mf.gov.pl and ec.europa.eu respectively, using the global fetch; the gus module performs no I/O and always throws (it is a not-yet-implemented stub). The attack surface is therefore limited to these two HTTP clients, the validation logic in @m8t-jacob/validate, and URL construction from user-supplied input (NIP, VAT number, country code, bank account number, date).

If you discover a security vulnerability, please do not open a public issue. Instead, report it privately via GitHub Security Advisories for this repository.

Please include:

• A description of the vulnerability and its potential impact
• Steps to reproduce (a minimal code sample is ideal)
• The package version affected

We aim to acknowledge reports within 5 business days and to release a fix as soon as reasonably possible.