Security

Report a vulnerability

Write to info@adspy.sh with the steps to reproduce, the affected URL or route and, if you have it, the X-Request-Id of a request. We answer within 3 business days and keep you informed until it is fixed. Our contact details for researchers are also at adspy.sh/.well-known/security.txt.

• Test only with your own organization and keys. Do not access, change or delete other organizations' data.
• Do not run denial of service, spam or social engineering, and do not copy the library.
• Give us reasonable time to fix an issue before you disclose it.

Keys

• Adspy stores a keyed hash of each key, never the key; it cannot be shown again.
• Keys expire (30, 90 or 365 days), rotate with a 24 hour overlap, can be limited to addresses and revoked at once.
• The adspy_sk_ prefix and checksum let secret scanners detect a leaked key.

Requests

• HTTPS only. Answers are Cache-Control: no-store and carry no CORS headers.
• Each organization reads only its own collections, exports and jobs; another organization's id answers 404.
• Errors never echo internal messages. Quote the X-Request-Id to support.

Your side

• Keep keys in a secret manager, one key per service, with only the permissions it needs.
• Never put a key in a browser, a mobile app or a repository.
• Rotate keys on a schedule and when someone with access leaves.