Until 1.0.0, security fixes are applied to the latest published preview. After the stable release, fixes will be applied to supported stable lines and the latest release candidate when applicable.

Use GitHub private vulnerability reporting for this repository. Do not open a public issue containing credentials, recipient numbers, message text, provider responses, or a proof of concept that can send real messages.

Include:

• affected package and version;
• affected target framework;
• minimal reproduction with secrets removed;
• expected and observed behavior;
• whether exploitation requires a valid gateway account;
• suggested mitigation, when known.

Rotate any credential that may have appeared in logs, traces, exception reports, CI output, screenshots, or test fixtures before submitting the report.

CodeyaSMS does not intentionally record message text, recipient numbers, pattern values, credentials, or full request URLs in its own telemetry. Kavenegar credentials are part of the request path required by that provider API. Applications must therefore avoid exporting full outbound HTTP URLs and must redact custom HTTP logs.

Live-provider tests are opt-in and must run only in protected environments. Repository fixtures must be sanitized and must never contain a usable API key, phone number, username, password, bot token, or provider session identifier.

Pull requests and release builds run dependency audit, static source checks, package-content validation, API-contract validation, and multi-platform tests. NuGet publication uses GitHub OIDC Trusted Publishing and a short-lived credential.