Security fixes are applied to the latest revision on the default branch. API Scout is intentionally small and local-first; the primary security surface is the optional public URL reachability check and the handling of contributor-supplied catalog metadata.

Please do not open a public issue for a suspected vulnerability. Instead, contact the repository owner through GitHub’s private security-advisory workflow, if enabled, or use the owner’s GitHub profile contact channel. Include a minimal reproduction, affected revision, impact description, and a suggested remediation if one is available.

API Scout does not accept, store, or transmit API credentials. Its check command permits only http and https URLs explicitly declared in the local catalog, sends no request body or authentication header, applies a timeout, and uses HEAD with a limited GET fallback for servers that do not support HEAD.

Catalog maintainers should reject entries that target loopback addresses, private networks, cloud metadata endpoints, user-specific paths, payment endpoints, authenticated services, or URLs whose sole purpose is to produce a side effect. Any future feature that broadens request behavior should include a threat model and tests for server-side request forgery, credential leakage, and unintended network side effects.