Skip to content
JustAPI

Security Policy

Supported Versions

Section titled “Supported Versions”
Version Supported
>= 1.0 ✅ Active
< 1.0 ⚠️ Dev-only (report anyway)

Reporting a Vulnerability

Section titled “Reporting a Vulnerability”

DO NOT file a public GitHub issue for security vulnerabilities.

Send details to security@justapi.dev with:

  1. Subject: [JustAPI Security] <brief description>
  2. Affected version(s)
  3. Type of vulnerability (e.g., XSS, RCE, SQL injection, information disclosure)
  4. Steps to reproduce (minimal proof of concept preferred)
  5. Impact assessment
  6. Suggested fix (optional)

Response Timeline

Section titled “Response Timeline”
  • 24h: Acknowledgment of receipt
  • 7 days: Triage and severity assessment
  • 90 days: Fix released (or extension negotiated)
  • Disclosure: Coordinated public disclosure after fix is available

Scope

Section titled “Scope”

In-Scope

Section titled “In-Scope”
  • JustAPI framework source code (all crates)
  • Official Docker images (ghcr.io/justapi/*)
  • Official Helm chart
  • Build pipeline and CI/CD configuration

Out-of-Scope

Section titled “Out-of-Scope”
  • Third-party plugins
  • Applications built with JustAPI (report to the app maintainer)
  • Infrastructure not owned by the JustAPI project

Bug Bounty

Section titled “Bug Bounty”

This project does not currently offer a paid bug bounty program. Contributors will be credited in release notes and the security hall of fame (opt-out available).

See Also

Section titled “See Also”