• Supported Versions
• Reporting a Vulnerability
• Response Timeline
• Security Measures
• Scope
• Known Limitations
• Security Headers
• Responsible Disclosure

We recommend always running the latest version. Check your version at /api/v1/health.

🔒 Please do NOT open a public GitHub issue for security vulnerabilities.

1. Go to GitHub Security Advisories
2. Click "New draft security advisory"
3. Fill in the details using the template below

The following are not security vulnerabilities:

• Rate limiting being too restrictive
• Upstream data accuracy issues (contact Toraka instead)
• Missing features or API enhancements
• Deprecation warnings in dependencies

We will keep you informed of progress via the security advisory. If we cannot fix an issue promptly, we'll explain why and provide a timeline.

• 60 requests per minute per IP address (sliding window)
• Rate limit headers on every response (X-RateLimit-Limit, X-RateLimit-Remaining)
• 429 Too Many Requests with Retry-After header when exceeded

• All query parameters validated before processing
• Slugs are normalized and sanitized (no path traversal, no injection)
• Search queries have a minimum length requirement (2 characters)
• Integer parameters bounds-checked (page, limit)

• HTTPS only — HTTP requests auto-redirect to HTTPS
• CORS — Configured for public API access (Access-Control-Allow-Origin: *)
• Security headers on all responses (see below)

• No authentication — No user credentials, tokens, or PII stored
• No user accounts — No registration, login, or user data collection
• Cache only — In-memory cache with automatic TTL expiration
• Upstream isolation — Toraka API keys/credentials are server-side only, never exposed to clients

• Vercel deployment — Automatic HTTPS, DDoS protection, edge caching
• GitHub Actions CI — Automated lint and build checks on every PR
• Dependency scanning — Dependabot configured for automatic security updates

Every API response includes:

Everything hosted under github.com/Shineii86/ShineiAPI:

• API route handlers (src/app/api/)
• Middleware (src/middleware.js)
• Cache layer (src/lib/cache.js)
• Toraka client (src/lib/toraka.js)
• Constants and configuration (src/lib/constants.js)
• Response helpers (src/lib/response.js)
• Frontend components and pages (src/app/, src/components/)
• Public assets (public/)
• Deployment config (vercel.json)

These are architectural trade-offs, not vulnerabilities:

We believe in responsible disclosure and will:

• ✅ Credit reporters in the fix announcement (unless they prefer anonymity)
• ✅ Communicate openly about timelines and progress
• ✅ Not take legal action against researchers who follow this policy
• ✅ Work with you to understand and validate the issue

contributors who responsibly disclosed vulnerabilities will be listed here

• 🔒 Security reports: GitHub Security Advisories
• 💬 General questions: GitHub Discussions
• 🐛 Non-security bugs: GitHub Issues

Thank you for helping keep ShineiAPI and its users safe! 🛡️