Security
Security & vulnerability disclosure
APIs.io is a small, independent operation. That is exactly why this page exists: the reporting path should be obvious and the commitments should be ones that can actually be met.
The machine-readable version is at
/.well-known/security.txt
(RFC 9116).
Reporting a vulnerability
Email info@apis.io with SECURITY in the subject line.
Include what makes it reproducible: the endpoint or URL, the request, what you expected, what happened, and anything about your setup that matters. A proof of concept helps.
What to expect
| Commitment | |
|---|---|
| Acknowledgement | Within 3 business days |
| Initial assessment | Within 10 business days |
| Fix or documented mitigation | Target 90 days, sooner where severity warrants |
| Credit | Named if you want it, anonymous if you do not |
There is no bug bounty. This is not a funded security programme — it is a small team that will read your report, take it seriously, and tell you honestly what is being done about it.
Scope
In scope
apis.io— the site, the API at/api/v1, and the MCP server at/mcp- The developer portal under
apis.io/developer/ - Key issuance, tier gating, and billing flows on the account page
Out of scope
- Findings against third-party platforms that host parts of the service (AWS, GitHub, Stripe) — report those to the platform.
- Volumetric denial of service, and anything requiring physical access or social engineering.
- Missing hardening headers or scanner output without a demonstrated impact.
Testing guidance
Test against your own data and your own key. The free tier is keyless and rate limited — please stay inside the published limits while testing rather than treating an authorization question as a load test.
Do not access, modify, or exfiltrate data belonging to anyone else. If you encounter personal data during testing, stop and say so in the report.
Good-faith research under this policy is welcome, and no legal action will be pursued over it.
Transport and authentication
The site and API are TLS 1.3. The API authenticates with an optional x-api-key header; the MCP
server uses OAuth. Keys belong in headers — never in a query string, and never in a URL that ends up
in a log or a referrer.
Current posture, measured rather than claimed: HSTS is not yet enabled, and the apis.io domain carries SPF but not DMARC or DNSSEC. Those are known gaps, tracked rather than papered over.