Security Policy

Supported Versions

Reporting a Vulnerability

DO NOT file a public GitHub issue for security vulnerabilities.

Send details to [email protected] with:

1. Subject: [JustAPI Security] <brief description>
2. Affected version(s)
3. Type of vulnerability (e.g., XSS, RCE, SQL injection, information disclosure)
4. Steps to reproduce (minimal proof of concept preferred)
5. Impact assessment
6. Suggested fix (optional but appreciated)

Response timeline

• 24h: Acknowledgment of receipt
• 7 days: Triage and severity assessment
• 90 days: Fix released (or extension negotiated)
• Disclosure: Coordinated public disclosure after fix is available

Scope

In-scope:

• JustAPI framework source code (all crates)
• Official Docker images (ghcr.io/justapi/*)
• Official Helm chart
• Build pipeline and CI/CD configuration

Out-of-scope:

• Third-party plugins
• Applications built with JustAPI (report to the app maintainer)
• Infrastructure not owned by the JustAPI project

Bug Bounty

This project does not currently offer a paid bug bounty program.
Contributors will be credited in the release notes and the
SECURITY.md hall of fame (opt-out available).

Hall of Fame

We thank the following researchers for their responsible disclosures:

None yet — be the first!