title: Security Policy
description: Supported versions, vulnerability reporting, and disclosure process for JustAPI — a high-performance FastAPI alternative built in Rust.
keywords: security policy, vulnerability reporting, FastAPI alternative, Rust web framework, JustAPI security

Supported Versions

Reporting a Vulnerability

DO NOT file a public GitHub issue for security vulnerabilities.

Send details to [email protected] with:

1. Subject: [JustAPI Security] <brief description>
2. Affected version(s)
3. Type of vulnerability (e.g., XSS, RCE, SQL injection, information disclosure)
4. Steps to reproduce (minimal proof of concept preferred)
5. Impact assessment
6. Suggested fix (optional)

Response Timeline

• 24h: Acknowledgment of receipt
• 7 days: Triage and severity assessment
• 90 days: Fix released (or extension negotiated)
• Disclosure: Coordinated public disclosure after fix is available

Scope

In-Scope

• JustAPI framework source code (all crates)
• Official Docker images (ghcr.io/justapi/*)
• Official Helm chart
• Build pipeline and CI/CD configuration

Out-of-Scope

• Third-party plugins
• Applications built with JustAPI (report to the app maintainer)
• Infrastructure not owned by the JustAPI project

Bug Bounty

This project does not currently offer a paid bug bounty program. Contributors will be credited in release notes and the security hall of fame (opt-out available).

See Also

• OWASP Compliance — OWASP Top 10 checklist
• Penetration Testing — Pentest guidelines
• Secure Configuration — Hardening guide