# Security notes

## Release 1.0.0

- The production dependency audit reports zero known vulnerabilities.
- Next.js and the React server packages were updated to their patched release lines before the final build.
- The application accepts no uploads, has no application account system, no database and no user-controlled server-side URL fetching.
- The public STRATO build is static and exposes no server-side application runtime.

The full development-tool audit reports two high-severity advisories inherited by Vinext 0.0.50 through its `image-size` build dependency. The affected parsers handle ICNS, JXL and HEIF metadata during local builds. This project builds only its committed, reviewed PNG/SVG assets and does not expose that parser to website visitors. npm's proposed fix is a breaking move to a Vinext beta release, so release 1.0.0 retains the validated Sites-compatible toolchain and documents the residual build-only risk rather than silently forcing a prerelease migration.

Re-evaluate the current Vinext release and this exception before the next source release. Do not build untrusted image files with the retained toolchain.
