Security fixes are provided for the latest release on main.

Do not open a public issue for a vulnerability, leaked secret, redaction bypass, webhook-verification bypass, or escape from the local/read-only safety boundary.

Use GitHub's Security → Report a vulnerability flow. If private reporting is unavailable, use https://pipsync.io/en/contact with a minimal, non-secret summary until a private channel is established.

Include the affected version, synthetic reproduction, impact, and expected safety boundary. Never include real API keys, broker credentials, customer payloads, account identifiers, signatures from production, or live trade data.

• base URL and loopback enforcement
• HTTP method allowlists
• secret/token redaction
• environment-only secret loading
• raw-body HMAC and timestamp-freshness verification
• payload and stream bounds
• rejection of live-mode fixtures