mirror of
https://github.com/zap-proto/zip.git
synced 2026-10-19 15:38:57 +00:00
zeekay
c581e0af7b
zip is shared protocol infra (the fiber-over-ZAP web framework used by every
Lux/Hanzo/Zoo Go binary — nodes, gateway, cloud, iam, kms, o11y, ai, …), so its
home is the ZAP protocol family (zap-proto/{go,http,zapd,zip}), NOT any one org's
brand namespace. This consolidates the rich framework (formerly hanzoai/zip v0.5.0
— Ctx/Handler/Errorf/Err*/HTTPError, typed handlers, middleware, runtime/extension
loading, openapi, validate, zaprpc) with the real ZAP transport (ListenZAP/
ListenHTTP/Serve over zap-proto/http) into ONE canonical module.
Module path github.com/hanzoai/zip -> github.com/zap-proto/zip. Code identical to
hanzoai/zip v0.5.0; promoted to v1.0.0 as the stable shared-infra framework. The
prior hanzoai/zip lineage is retired — one home, one import path, one way.
Verified: go build/vet/test ./... green; the ZAP round-trip integration test serves
/v1/health over the real ZAP transport (200 + handler JSON).
786 B
786 B
Security Policy
Reporting a vulnerability
Email [email protected] with details. Encrypt with our PGP key (fingerprint TBD).
We respond within 48 hours. Critical issues receive same-day acknowledgment.
Scope
This policy covers code in this repository. For the broader Hanzo platform threat model, see hanzoai/HIPs.
Sandbox boundary
zip is a Go web framework with no privileged surface of its own — it executes only handler code registered by its consumer. Trust is delegated to the calling service: middlewares for JWT validation, identity-header strip+mint, rate limiting, and CORS must be configured by the consumer per the Hanzo platform contract.
For runtime sandbox guarantees, see HIP-0105 (in-process extension runtimes).