Supported Versions
| Version | Supported |
|---|---|
| >= 1.0 | ✅ Active |
| < 1.0 | ⚠️ Dev-only (report anyway) |
Reporting a Vulnerability
DO NOT file a public GitHub issue for security vulnerabilities.
Send details to security@justapi.dev with:
- Subject:
[JustAPI Security] <brief description> - Affected version(s)
- Type of vulnerability (e.g., XSS, RCE, SQL injection, information disclosure)
- Steps to reproduce (minimal proof of concept preferred)
- Impact assessment
- Suggested fix (optional)
Response Timeline
- 24h: Acknowledgment of receipt
- 7 days: Triage and severity assessment
- 90 days: Fix released (or extension negotiated)
- Disclosure: Coordinated public disclosure after fix is available
Scope
In-Scope
- JustAPI framework source code (all crates)
- Official Docker images (
ghcr.io/justapi/*) - Official Helm chart
- Build pipeline and CI/CD configuration
Out-of-Scope
- Third-party plugins
- Applications built with JustAPI (report to the app maintainer)
- Infrastructure not owned by the JustAPI project
Bug Bounty
This project does not currently offer a paid bug bounty program. Contributors will be credited in release notes and the security hall of fame (opt-out available).
See Also
- OWASP Compliance — OWASP Top 10 checklist
- Penetration Testing — Pentest guidelines
- Secure Configuration — Hardening guide