Skip to content

Security: costkits/costkits-api

Security

SECURITY.md

Security Policy

Reporting a Vulnerability

If you believe you've found a security vulnerability in the CostKits API, the widgets, or anything at costkits.com / api.costkits.com:

Email api@costkits.com with subject line SECURITY. Please do not open a public GitHub issue.

Include what you can:

  • A description of the issue and its impact
  • Steps to reproduce (requests/responses, minus any real API keys or personal data)
  • Any suggested fix

You'll get an acknowledgment within 72 hours. We ask that you give us a reasonable window to remediate before any public disclosure.

Scope notes

  • API keys: if you find a leaked key (in this repo, in docs, anywhere), report it — leaked keys are revoked immediately.
  • Health data: the API is stateless for estimates and bill analysis; do not include real patient-identifying information in reports or issue reproductions.
  • This repository contains only documentation and examples — but reports about anything in it (e.g., an example that encourages an unsafe pattern) are still welcome.

There aren't any published security advisories