# Security

# Security & vulnerability disclosure

APIs.io is a small, independent operation. That is exactly why this page exists: the reporting path
should be obvious and the commitments should be ones that can actually be met.

The machine-readable version is at
[`/.well-known/security.txt`](https://apis.io/.well-known/security.txt)
([RFC 9116](https://www.rfc-editor.org/rfc/rfc9116.html)).

## Reporting a vulnerability

Email **info@apis.io** with `SECURITY` in the subject line.

Include what makes it reproducible: the endpoint or URL, the request, what you expected, what
happened, and anything about your setup that matters. A proof of concept helps.

## What to expect

| | Commitment |
| --- | --- |
| Acknowledgement | Within **3 business days** |
| Initial assessment | Within **10 business days** |
| Fix or documented mitigation | Target **90 days**, sooner where severity warrants |
| Credit | Named if you want it, anonymous if you do not |

There is no bug bounty. This is not a funded security programme — it is a small team that will read
your report, take it seriously, and tell you honestly what is being done about it.

## Scope

**In scope**

- `apis.io` — the site, the API at `/api/v1`, and the MCP server at `/mcp`
- The developer portal under `apis.io/developer/`
- Key issuance, tier gating, and billing flows on the account page

**Out of scope**

- Findings against third-party platforms that host parts of the service (AWS, GitHub, Stripe) —
  report those to the platform.
- Volumetric denial of service, and anything requiring physical access or social engineering.
- Missing hardening headers or scanner output without a demonstrated impact.

## Testing guidance

Test against your own data and your own key. The free tier is keyless and rate limited — please stay
inside [the published limits](./rate-limits) while testing rather than treating an authorization
question as a load test.

Do not access, modify, or exfiltrate data belonging to anyone else. If you encounter personal data
during testing, stop and say so in the report.

Good-faith research under this policy is welcome, and no legal action will be pursued over it.

## Transport and authentication

The site and API are TLS 1.3. The API authenticates with an optional `x-api-key` header; the MCP
server uses OAuth. Keys belong in headers — never in a query string, and never in a URL that ends up
in a log or a referrer.

Current posture, measured rather than claimed: HSTS is **not** yet enabled, and the apis.io domain
carries SPF but **not** DMARC or DNSSEC. Those are known gaps, tracked rather than papered over.