Security & vulnerability disclosure

APIs.io is a small, independent operation. That is exactly why this page exists: the reporting path should be obvious and the commitments should be ones that can actually be met.

The machine-readable version is at /.well-known/security.txt (RFC 9116).

Reporting a vulnerability

Email [email protected] with SECURITY in the subject line.

Include what makes it reproducible: the endpoint or URL, the request, what you expected, what happened, and anything about your setup that matters. A proof of concept helps.

What to expect

	Commitment
Acknowledgement	Within 3 business days
Initial assessment	Within 10 business days
Fix or documented mitigation	Target 90 days , sooner where severity warrants
Credit	Named if you want it, anonymous if you do not

There is no bug bounty. This is not a funded security programme — it is a small team that will read your report, take it seriously, and tell you honestly what is being done about it.

Scope

In scope

apis.io — the site, the API at /api/v1, and the MCP server at /mcp
The developer portal under apis.io/developer/
Key issuance, tier gating, and billing flows on the account page

Out of scope

Findings against third-party platforms that host parts of the service (AWS, GitHub, Stripe) — report those to the platform.
Volumetric denial of service, and anything requiring physical access or social engineering.
Missing hardening headers or scanner output without a demonstrated impact.

Testing guidance

Test against your own data and your own key. The free tier is keyless and rate limited — please stay inside the published limits while testing rather than treating an authorization question as a load test.

Do not access, modify, or exfiltrate data belonging to anyone else. If you encounter personal data during testing, stop and say so in the report.

Good-faith research under this policy is welcome, and no legal action will be pursued over it.

Transport and authentication

The site and API are TLS 1.3. The API authenticates with an optional x-api-key header; the MCP server uses OAuth. Keys belong in headers — never in a query string, and never in a URL that ends up in a log or a referrer.

Current posture, measured rather than claimed: HSTS is not yet enabled, and the apis.io domain carries SPF but not DMARC or DNSSEC. Those are known gaps, tracked rather than papered over.

Last modified on August 21, 2026

Deprecation & Versioning