Do not open a public issue for a suspected vulnerability. Send a report to info@neplextech.com with the affected version, impact, reproduction steps, and any suggested mitigation. Avoid including production secrets, personal data, access tokens, or private keys in the report.

The maintainers will acknowledge a complete report, assess the affected versions, and coordinate a fix and disclosure timeline when the report is confirmed.

Redactive is intended to reduce accidental sensitive-data exposure. Pattern detection can have false positives and false negatives, and use of the library does not establish regulatory compliance. Applications remain responsible for access control, secret management, data retention, and policy validation.

The default compiler does not evaluate generated code. The optional codegen: true mode uses new Function and must be enabled only for trusted, application-owned exact paths. Do not pass user-controlled paths into generated compilation. Deployments with a Content Security Policy that blocks dynamic code construction must use the default compiler.

Generated mode rejects __proto__, prototype, and constructor path segments. Unsupported features fail during redactor creation instead of falling back silently. See the generated compilation section in README.md for the complete capability boundary.