---
title: Security Policy
description: Supported versions, vulnerability reporting, and disclosure process for JustAPI — a high-performance FastAPI alternative built in Rust.
keywords: security policy, vulnerability reporting, FastAPI alternative, Rust web framework, JustAPI security
---

## Supported Versions

| Version | Supported |
|---|---|
| >= 1.0 | ✅ Active |
| < 1.0 | ⚠️ Dev-only (report anyway) |

## Reporting a Vulnerability

**DO NOT** file a public GitHub issue for security vulnerabilities.

Send details to **security@justapi.dev** with:

1. **Subject**: `[JustAPI Security] <brief description>`
2. **Affected version(s)**
3. **Type of vulnerability** (e.g., XSS, RCE, SQL injection, information disclosure)
4. **Steps to reproduce** (minimal proof of concept preferred)
5. **Impact assessment**
6. **Suggested fix** (optional)

### Response Timeline

- **24h**: Acknowledgment of receipt
- **7 days**: Triage and severity assessment
- **90 days**: Fix released (or extension negotiated)
- **Disclosure**: Coordinated public disclosure after fix is available

## Scope

### In-Scope

- JustAPI framework source code (all crates)
- Official Docker images (`ghcr.io/justapi/*`)
- Official Helm chart
- Build pipeline and CI/CD configuration

### Out-of-Scope

- Third-party plugins
- Applications built _with_ JustAPI (report to the app maintainer)
- Infrastructure not owned by the JustAPI project

## Bug Bounty

This project does not currently offer a paid bug bounty program. Contributors will be credited in release notes and the security hall of fame (opt-out available).

## See Also

- [OWASP Compliance](/security/owasp-compliance/) — OWASP Top 10 checklist
- [Penetration Testing](/security/penetration-testing/) — Pentest guidelines
- [Secure Configuration](/security/secure-configuration/) — Hardening guide