Until the first stable release, security fixes are provided for the latest published 0.x version only.

Please do not open a public issue for a suspected vulnerability. Use GitHub's private vulnerability reporting at https://github.com/pipsyncio/pipsync-sdk/security/advisories/new. If that is unavailable, contact PipSync Support through https://pipsync.io/support and state that the report concerns the public SDK.

Include the affected package and version, impact, reproduction steps using synthetic data, and any suggested mitigation. Do not include production API keys, webhook secrets, broker credentials, customer payloads, or personal data.

We will acknowledge receipt as soon as practical, investigate privately, and coordinate a fix and disclosure timeline with the reporter.

• Credentials are caller-supplied and remain in memory. The SDK does not read .env files or environment variables and never persists credentials.
• HTTPS is mandatory for non-loopback API hosts.
• Webhook verification requires the exact raw body, HMAC-SHA256, a timestamp tolerance, constant-time signature comparison, and optionally a caller-owned durable replay claim.
• The SDK contains no trade execution or broker-credential APIs.
• Report schedule creation is not automatically retried.

Applications remain responsible for secret storage, access control, durable replay state, request logging/redaction, dependency updates, and TLS termination.