| Version | Supported |
|---|---|
| 2.4.x | ✅ |
| < 2.4 | ❌ |
Fixes land on the latest release. If you are running an older version, upgrade before reporting — the issue may already be resolved.
Please do not open a public issue or pull request for a security problem. Public reports expose every running instance until a fix ships.
Report privately instead:
- Preferred — GitHub private vulnerability reporting. Use the Report a vulnerability button on the Security tab. This keeps the discussion private until an advisory is published.
- Fallback — Telegram. If private reporting is unavailable, message @Shineii86 asking for a private channel. Send only a one-line description there, not the full details.
The more of this you can provide, the faster a fix can be confirmed:
- The affected endpoint or module, and the version or commit you tested.
- What an attacker can achieve — reading data, changing state, exhausting resources.
- Minimal steps to reproduce, ideally a single request.
- Whether authentication or any particular deployment setup is required.
- A suggested fix, if you have one.
- Reports are acknowledged as soon as the maintainer sees them.
- Once confirmed, a fix is prepared privately and released, and a GitHub advisory is published crediting the reporter unless anonymity is requested.
- Reporters are asked to hold public details until the fix is released.
This project is maintained by one person as unpaid work. Please read the timing above as intent rather than a guaranteed schedule.
In scope — anything that lets someone abuse a deployed instance:
- Server-side request forgery, or any way to make the server fetch or reach destinations it should not.
- Injection, path traversal, or unsafe handling of caller-supplied input.
- Leakage of environment variables, credentials, or internal configuration.
- Denial of service reachable through a single unauthenticated request.
- Vulnerable dependencies with a practical path to exploitation in this codebase.
Out of scope:
- Availability, downtime, or changes to the upstream anime sites this API scrapes.
- Rate limiting or abuse controls on those upstream sites.
- Findings that require an already-compromised host or shell access to the server.
- Reports produced by automated scanners with no demonstrated impact.