Please report security issues privately through GitHub Security Advisories rather than as a public issue.

Expect an acknowledgement within 72 hours and an assessment within seven days.

The latest minor release receives security fixes. This project is pre-1.0.

hardrefresh reads header configuration and a build directory, then prints text. The following are in scope:

• Code execution while scanning. Nothing in a scanned repository should ever be executed. Configuration is parsed as data, build output is listed rather than read, and no JavaScript from the site is loaded.
• Denial of service. A crafted configuration or directory tree that makes a scan hang or exhaust memory. Directory descent is depth- and count-capped, and path patterns are compiled to anchored expressions rather than evaluated.
• Report injection. Terminal escape sequences in a path, a pattern or a header value that repaint the report and forge a clean verdict. Control characters are stripped and text is length-capped before printing.
• Path traversal. A construction that gets the walker to read outside the scanned directory, including through --build-dir.
• Silent under-reporting. A configuration constructed so that a genuinely pinned file is reported as fresh. Because this tool is used as a gate before a deploy, a reliable way to produce a false clean report is worth more to an attacker than a crash.

• A wrong verdict. A missed pin or a false alarm is a correctness bug and a genuinely useful report, but it is not a security issue. The deliberate non-findings documented in docs/rules.md are by design.
• The caching behaviour of sites hardrefresh scans. That is the finding.
• Headers this tool cannot see. Anything set by an edge function, a framework or a CDN dashboard is outside the repository and is documented as a limitation rather than claimed otherwise.

Caching has genuine security consequences — a public directive on an authenticated response can leak one user's data to another through a shared cache. This tool does not check for that. It reasons about static build output, where every response is public by construction, and extending it to authenticated responses would require knowing which routes are authenticated, which it cannot see. Do not read a clean report here as a statement about cache safety on a dynamic application.

• No network access. It never requests the site, never contacts a CDN, and never resolves a host.
• Read-only. hardrefresh never writes to the repository it scans.
• Zero runtime dependencies. Installing it does not widen your supply chain.
• No install script.