Tweetapi Vulnerability Disclosure

generated: '2026-08-11'
method: searched
probe: true
source: https://github.com/tweetapi/agent-skill/blob/main/SECURITY.md
scope: repository
policy:
  - https://github.com/tweetapi/agent-skill/blob/main/SECURITY.md
contact:
  - https://tweetapi.com
  - support@tweetapi.com
channels:
  - {kind: github-private-vulnerability-reporting, target: 'github.com/tweetapi/agent-skill', primary: true}
  - {kind: website-contact, target: 'https://tweetapi.com', note: 'named fallback when private reporting is unavailable'}
bug_bounty:
  program: false
  platform: null
security_txt:
  served: false
  note: /.well-known/security.txt returns 404 on tweetapi.com, api.tweetapi.com and mcp.tweetapi.com.
published_guidance:
  - Do not open a public issue containing a credential, exploit detail, private response or user data
  - Never commit TweetAPI keys or Twitter/X credentials
  - Never request or store passwords, cookies, authToken, ct0, TOTP codes, proxy credentials or DM content
  - Use OAuth for the hosted MCP server; keep REST and SDK API keys in a server-only secret store
  - Redact authorization headers and sensitive inputs from logs and bug reports
  - Revoke an exposed credential through its issuing service before reporting the incident
evidence:
  - {source: 'https://raw.githubusercontent.com/tweetapi/agent-skill/main/SECURITY.md', http_status: 200, kind: SECURITY.md, fetched: '2026-08-11'}
  - {source: 'https://tweetapi.com/.well-known/security.txt', http_status: 404, kind: security.txt, fetched: '2026-08-11'}
  - {source: 'https://tweetapi.com/security', http_status: 404, kind: disclosure-page, fetched: '2026-08-11'}
caveat: >-
  This is a genuine, provider-authored vulnerability-reporting policy, but its stated scope is the
  agent-skill repository rather than the TweetAPI service. It is the only disclosure channel the
  provider publishes anywhere: probe-security-programs.py found no security.txt, no /security or
  /responsible-disclosure page, and no bug-bounty listing. Recommended provider fix: serve an RFC
  9116 /.well-known/security.txt on tweetapi.com and api.tweetapi.com naming a service-scoped
  contact and policy URL.
trust_center:
  found: false
  note: >-
    No trust.tweetapi.com, no security.tweetapi.com, no /trust or /compliance page, and no named
    certifications. No trust-center artifact is emitted and no Compliance pointer is wired.