# Security

Adspy API · https://www.adspy.sh/docs/api/security · Updated October 24, 2026

How keys and requests are protected, and how to reach us about a vulnerability.

## Report a vulnerability

Write to info@adspy.sh with the steps to reproduce, the affected URL or route and, if you have it, the X-Request-Id of a request. We answer within 3 business days and keep you informed until it is fixed. Our contact details for researchers are also at https://www.adspy.sh/.well-known/security.txt.

- Test only with your own organization and keys. Do not access, change or delete other organizations' data.
- Do not run denial of service, spam or social engineering, and do not copy the library.
- Give us reasonable time to fix an issue before you disclose it.

## Keys

- Adspy stores a keyed hash of each key, never the key; it cannot be shown again.
- Keys expire (30, 90 or 365 days), rotate with a 24 hour overlap, can be limited to addresses and revoked at once.
- The adspy_sk_ prefix and checksum let secret scanners detect a leaked key.

## Requests

- HTTPS only. Answers are Cache-Control: no-store and carry no CORS headers.
- Each organization reads only its own collections, exports and jobs; another organization's id answers 404.
- Errors never echo internal messages. Quote the X-Request-Id to support.

## Your side

- Keep keys in a secret manager, one key per service, with only the permissions it needs.
- Never put a key in a browser, a mobile app or a repository.
- Rotate keys on a schedule and when someone with access leaves.