harden: block prototype pollution in index.js (CWE-1321)

[anupamme]

The GeoJSONVT constructor accepts a user-controlled 'options' object and merges it using Object.assign without sanitizing prototype-polluting keys (proto, constructor, prototype). This allows an attacker to pollute the Object prototype, potentially affecting all objects in the application. This is defence-in-depth at src/index.js:29 rather than a vulnerability I can show is exploitable here — it makes the failure mode explicit and bounded. Close it freely if the pattern is intentional.

Reference: CWE-1321

What changed

• src/index.js

Verification

No automated check could be run against this repository, so this change is unverified beyond review. Please treat it as a suggestion.

---

Automated security fix by OrbisAI Security

[mourner]

Nope, absolutely unnecessary.

[anupamme]

Thanks for taking a look. Agreed. I don’t have a demonstrated attacker-controlled path to the constructor in the current API, so this is better characterised as a defense-in-depth/static-pattern finding rather than a confirmed vulnerability.