Security

Reporting a vulnerability

Write to [email protected] with "Security" in the subject. Say which package and version, what an attacker can do, and how to reproduce it. Please do not open a public issue or post details before a fix is released.

We answer within 5 working days, tell you what we will do and when, and credit you in the changelog if you wish.

In scope

The packages published under @haatlabs on npm, and the code haatlabs create writes into a new app.

Out of scope

Apps built with the packages (their owners run them), and the haatlabs API on RapidAPI's own platform (report RapidAPI issues to RapidAPI).

What a new app starts with

• Row-level security in Postgres: every query of a request runs as its organization.
• Sign-in codes and API keys stored as hashes; Shopify access tokens encrypted.
• Rate limits on sign-in, and HTTPS only, through Caddy.
• Errors that never show their details to the client; the details go to the log.