We take security seriously. If you discover a security vulnerability in arcasdk, please do not open a public issue. Instead, follow these steps:

1. Email: Send a detailed report to the repository maintainers (check CONTRIBUTING.md for contact info)
2. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if you have one)

• Acknowledgment of your report within 48 hours
• Regular updates on our progress
• Credit in security advisories (unless you prefer anonymity)
• Coordinated disclosure timeline

1. Keep dependencies updated:

   npm audit
   npm update

2. Use in secure environments:

   • Only use in trusted environments
   • Protect your credentials (certificates, keys)
   • Don't commit credentials to version control

3. Certificate Management:

   • Store certificates securely (e.g., environment variables, AWS Secrets Manager)
   • Use separate certificates for testing and production
   • Rotate certificates periodically

4. Audit Logging:

   • Log API calls for compliance
   • Monitor for unusual activity

None currently reported. Check GitHub Issues for any open discussions.

• AFIP Integration: Follows AFIP security guidelines for electronic invoicing
• SSL/TLS: Uses secure protocols for all communications
• Input Validation: All inputs are validated before processing

We use:

• npm audit in CI/CD to detect vulnerabilities
• Dependabot for automated dependency updates
• Regular dependency reviews