Security disclosure policy

Last updated 2 November 2026

Why this matters to us

Players trust swgoh-api with access to their game accounts. A flaw that lets anyone act on an account without its player's consent, read another player's or developer's data, or reach a stored game session is the most serious thing that can happen to this service. We want to hear about it first.

How to report

Email security@swgoh-api.dev with:

• what you found and where (host, API route, page or SDK);
• steps to reproduce it, with any request IDs (X-Request-Id) you have;
• the impact as you understand it;
• how you would like to be credited, if at all.

Please do not include other people's personal data in your report.

In scope

• The API at api.swgoh-api.dev, including OAuth and webhook delivery
• The developer portal at developers.swgoh-api.dev
• The player portal and consent screens at account.swgoh-api.dev
• The status page, the documentation site and this website
• Our official SDKs (TypeScript, Python and Rust)

Out of scope

• The game's own servers and the publisher's accounts. Never test against them, and never use swgoh-api to act on a game account you do not own.
• The operator console and anything behind Cloudflare Access (report exposure, but do not try to get in)
• Infrastructure run by Cloudflare, Google Cloud, Stripe, Discord or GitHub themselves
• Bots and apps built by other developers on top of swgoh-api
• Denial-of-service and volume testing, social engineering, physical attacks
• Findings with no security impact, such as missing headers on pages without sensitive content or rate limits working as documented

Rules for testing

• Use only developer accounts, API keys, OAuth apps and game accounts that you own.
• Stay within the documented rate limits and quotas.
• If you reach anyone else's data, a stored credential or a game session, stop, do not keep or use it, and report straight away.
• Do not change or delete data that is not yours, and do not degrade the service for others.
• Give us a reasonable time to fix the issue before you disclose it (see below).

Our commitments

• We aim to acknowledge your report within 3 business days and to give a first assessment within 10.
• We keep you informed while we fix it, and tell you when it is fixed.
• With your permission, we credit you when we publish the fix.
• If you act in good faith and follow this policy, we consider your research authorised, we will not pursue or support legal action against you for it, and if a third party does, we will make it known that you acted with our permission.

We do not run a paid bug bounty at the moment.

Disclosure

We ask for 90 days from your report before public disclosure, or less once a fix is released. If we need longer, we explain why and agree a date with you.

Machine-readable contact details are in /.well-known/security.txt.