If you discover a security issue, do not open a public issue. Contact repository maintainers privately (or open a GitHub Security Advisory if enabled).

• Never commit VeriFido:ApiKey, VeriFido:Redis:ConnectionString, or .env to git; inject secrets through the deployment secret provider
• RP host GET /fido2/config must not expose ApiKey (the package filters it)
• Production environments should configure the full VeriFido section and use ValidateOnStart
• Configure VeriFido:AllowedOrigins as an explicit HTTPS browser-origin allowlist; never use *
• Never log Redis connection strings or serialized transaction payloads; keep usernames, transaction IDs where sensitive, credential IDs/material, raw WebAuthn data, OTPs, and tokens out of keys and logs
• The built-in limiter is a baseline control; enforce additional account/device limits at the BFF or edge
• MemoryFidoTransactionStore is development/single-instance only; multi-Pod, rolling-deployment, autoscaling, restart, or failover scenarios require VeriFido:TransactionStore=Redis with one shared atomic Redis deployment
• Operate Redis as a security dependency: use Redis 6.2 or newer for atomic GETDEL, provision HA appropriate to the service objective, monitor availability/capacity, and prevent eviction of live pending-ceremony keys
• Redis applies TransactionLifetimeSeconds as server-side TTL. Size memory and throughput for peak pending ceremonies plus serialized payload overhead; reads and failed consumes do not extend TTL
• Redis keys are namespaced by Redis:EnvironmentName, Redis:ApplicationName, and ceremony-qualified transaction key. Use distinct namespace values per deployment and never place payload, username, credential, OTP, or token data in namespace segments
• Redis connection, timeout, command, and serialization failures fail closed and do not fall back to memory; make deployment availability and incident handling account for blocked ceremonies during Redis outages
• Replace IFidoRpRequestAuthorizer with the host application's authenticated-account and OTP policy before exposing bind endpoints in production
• User removal must remain locked to the authenticated session identity

This project is an unofficial community VeriFido integration library. It does not include HiTRUST infrastructure. For infrastructure or credential issues, contact HiTRUST support channels.