Security & Responsible Disclosure
Last updated: January 01, 2026
Security is part of how we operate Passports API. We welcome clear, good-faith reports that help us protect our website, services, clients, and data.
1. How to report a concern
Use our security contact form. Include the exact affected hostname and URL, a concise description, reproducible steps, the demonstrated security impact, and relevant timestamps. Screenshots or redacted request and response details can help us validate the report.
Never send passwords, private keys, raw session cookies, complete access tokens, payment information, or personal data. Redact secrets while preserving enough context for us to reproduce the issue safely.
2. Authorization and scope
Passports API does not operate a public bug-bounty program or grant standing permission for active security testing. Written authorization from Passports API is required before scanning, exploiting, or testing any system beyond passive observation and ordinary intended use.
Only the systems and methods expressly identified in written authorization are in scope. Third-party services, clients, technology partners, infrastructure providers, and unrelated domains are always out of scope unless they are explicitly included.
3. Prohibited activity
Do not access, retain, change, or delete data that is not yours. Do not perform denial-of-service testing, automated high-volume scanning, credential attacks, social engineering, phishing, physical testing, malware deployment, persistence, or testing that may degrade service or affect another person.
If you encounter sensitive information or unintended access, stop immediately, do not copy or retain the data, and report what you observed through the security contact form.
4. Our review process
We review reports for reproducibility, affected scope, practical impact, and whether the activity complied with these guidelines. We may request additional redacted evidence. Please allow us a reasonable opportunity to investigate and remediate a validated issue before any public disclosure.
5. Bounties and compensation
Submitting a report does not create an entitlement to compensation. No bounty, reward, reimbursement, or other payment is promised unless Passports API agreed to it in writing before testing began.
6. Contact
Submit a report using the security contact form. Our machine-readable disclosure information is available at /.well-known/security.txt.