Do not open a public issue for a suspected vulnerability. Use this repository's Security tab to submit a private security advisory. If private reporting is unavailable, contact PipSync through pipsync.io/support and request a private channel without including exploit details in the initial message.

Include the affected version or commit, impact, prerequisites, and a minimal synthetic reproduction. Never send API keys, webhook secrets, authorization headers, broker credentials, account IDs, customer payloads, private endpoints, or unredacted production logs.

The latest release line and the default branch receive security fixes. Older releases may require an upgrade. A security fix that changes the public interface will include migration notes.

This package intentionally has no transport authentication, network client, credential store, durable receipt store, or order execution adapter. Those absences are safety boundaries, not missing convenience features.

Hosts integrating a connector must:

1. authenticate the exact raw delivery before trusting parsed fields
2. scope durable source identities by provider, tenant, endpoint, and environment as applicable
3. atomically claim an idempotency key before persistence or side effects
4. prevent logs and errors from exposing raw payloads or secrets
5. route only complete, explicitly authorized signals through independent risk and execution controls

The in-memory PaperSink is for tests and demos. It does not coordinate processes, survive restarts, simulate a broker fill, or prove production replay safety.

Use only systems and accounts you own or are explicitly authorized to test. Do not access other users' data, place or modify live orders, degrade a service, or retain sensitive data. PipSync intends not to pursue action against good-faith research that follows this policy and allows reasonable remediation time; third-party rights and applicable law still apply.