Security
Security & vulnerability disclosure
API Evangelist is a small, independent operation. That is exactly why this page exists: the reporting path should be obvious and the response commitments should be ones that can actually be met, rather than a boilerplate promise nobody is staffed to keep.
The machine-readable version of this page is at
/.well-known/security.txt (RFC 9116).
Reporting a vulnerability
Email [email protected] with SECURITY in the subject line.
Please include what you need to make it reproducible: the endpoint or URL, the request, what you expected, what happened, and anything about your setup that matters. A proof of concept helps.
What to expect
| Commitment | |
|---|---|
| Acknowledgement | Within 3 business days |
| Initial assessment | Within 10 business days |
| Fix or documented mitigation | Target 90 days, sooner where the severity warrants it |
| Credit | Named in the changelog if you want it, anonymous if you do not |
There is no bug bounty. This is not a funded security programme — it is one person who will read your report, take it seriously, and tell you honestly what is being done about it.
Scope
In scope
api.apievangelist.com— the Network API and the Governance & Discovery APImcp.apievangelist.com— the MCP server and its OAuth 2.1 authorization serverdeveloper.apievangelist.com— this portalapievangelist.comand the network subdomains
Out of scope
- Findings against third-party platforms hosting parts of the network (GitHub, Cloudflare, AWS) — report those to the platform.
- Volumetric denial of service, and anything requiring physical access or social engineering of the operator.
- Missing hardening headers, or scanner output, without a demonstrated impact.
Testing guidance
Test against your own data. The API's free tier is keyless and rate-limited — please stay inside those limits while testing rather than treating an authorization question as a load-test.
Do not access, modify, or exfiltrate data belonging to anyone else. If you encounter personal data during testing, stop and say so in the report.
Good-faith research under this policy is welcome, and no legal action will be pursued over it.
Transport and authentication
The whole network is TLS 1.3. The API authenticates with x-api-key; the MCP server uses
OAuth 2.1 with RFC 9728 protected-resource
metadata. Keys and tokens belong in headers — never in a query string, and never in a URL that
ends up in a log or a referrer.