Security fixes are prioritized for the latest code on the default branch (main).
| Version | Supported |
|---|---|
main |
✅ |
| older commits / forks | ❌ (please upgrade or rebase) |
If you discover a security vulnerability in API Explorer, please report it privately. Do not open a public GitHub issue or discuss the details in a pull request until a fix is available.
Use GitHub's private vulnerability reporting for this repository when it is enabled:
- Go to the repository on GitHub.
- Open the Security tab.
- Choose Report a vulnerability (or Advisories → report privately).
- Include as much detail as you can (see below).
If private vulnerability reporting is not yet enabled on the repository, contact the maintainers privately through GitHub (for example, via a private security advisory request or maintainer contact options shown on the repository/profile). Do not publish exploit details publicly.
- A clear description of the issue and its impact
- Steps to reproduce, or a proof of concept if safe to share privately
- Affected areas of the project (for example:
/api/proxy, client request execution, import parsers) - Suggested remediation if you have one
- Your preferred contact method for follow-up
- Maintainers will acknowledge reports as soon as practical.
- You may be asked for clarification or additional reproduction details.
- If the report is accepted, maintainers will work on a fix and coordinate disclosure.
- If the report is declined (for example, not considered a vulnerability or out of scope), you will receive an explanation.
API Explorer includes a server-side request proxy (POST /api/proxy) used to send outbound HTTP requests. Reports related to proxy abuse, SSRF-style concerns, unsafe URL handling, or injection through imported specs/collections are especially welcome when filed privately.
Thank you for helping keep the project and its users safe.