> For the complete documentation index, see [llms.txt](https://docs.ipcheck.ing/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ipcheck.ing/developer/contributing/security-policy.md).

# Security Policy

MyIP handles network diagnostics, IP data, and optional third-party API keys. If you find a vulnerability, the project wants to hear about it.

This page reproduces [`SECURITY.md`](https://github.com/jason5ng32/MyIP/blob/main/SECURITY.md) in the repository. That file is the authoritative version.

## How to report

{% hint style="warning" %}
The project's stated channel is **GitHub Issues** — the same tracker used for bugs. There is no separate security email address and no private advisory process documented. Keep the report factual and avoid publishing a working exploit in the issue body.
{% endhint %}

{% stepper %}
{% step %}

### Open an issue

Create a new issue on the [MyIP issues page](https://github.com/jason5ng32/MyIP/issues). Give a clear, detailed description of the potential vulnerability, and include steps to reproduce it if you can.
{% endstep %}

{% step %}

### Don't disclose publicly elsewhere

Do not publicise the vulnerability — blog posts, social media, mailing lists — until the maintainers have had a chance to address it.
{% endstep %}

{% step %}

### Expect an acknowledgement within 48 hours

The project aims to respond to security reports within 48 hours, confirming receipt.
{% endstep %}

{% step %}

### Follow the thread

Progress updates are posted in the GitHub issue thread.
{% endstep %}
{% endstepper %}

## What happens next

On receiving a report, the maintainers will:

* Investigate the issue promptly.
* Develop a fix and test it thoroughly.
* Release an updated version that addresses it.
* Provide further updates and patches as needed.

Reporters are credited in the issue thread and, if a fix ships, in the release notes.

## Supported versions

`SECURITY.md` does not define a supported-version policy. In practice, fixes land on the latest release. If you self-host, upgrade to the current version before reporting — and expect any fix to be delivered as a new release rather than a backport.

## What counts as a security issue

MyIP is a self-hostable IP toolbox: a Vue 3 SPA plus an Express API that proxies a set of third-party data sources. Reports that fit that shape include:

| Area              | Examples                                                                                                                                 |
| ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| Secret exposure   | API keys or MaxMind credentials leaking into the frontend bundle, logs, or API responses                                                 |
| Access control    | Bypassing the referer check or IP validation that guards `/api/*` — see [Security Options](/developer/configuration/security-options.md) |
| Injection         | Command, header, or template injection through user-supplied hosts, IPs, or domains                                                      |
| SSRF              | Making the backend fetch an attacker-chosen internal address through a lookup endpoint                                                   |
| XSS               | Unescaped upstream data rendered into the page                                                                                           |
| Privacy leaks     | Client IPs or diagnostic results reaching somewhere they should not, including telemetry                                                 |
| Dependency issues | A vulnerable package that MyIP actually exercises in a reachable code path                                                               |

<details>

<summary>Usually not a security issue</summary>

* **Missing optional API keys**, or a degraded feature when a key is absent. That is expected behavior — see [Optional API Keys](/developer/configuration/optional-api-keys.md).
* **The app revealing your own IP address and browser fingerprint.** That is the product.
* **Behavior of an upstream data provider.** Report it to that provider.
* **A misconfigured deployment** — an exposed backend port, a missing reverse proxy, permissive CORS you set yourself. Start with [Reverse Proxy & Domains](/developer/getting-started/reverse-proxy-and-domains.md) and [Security Options](/developer/configuration/security-options.md).
* **Scanner output with no demonstrated impact.** Show how it is exploitable in MyIP.

</details>

## Reporting non-security bugs

Ordinary bugs go through the normal templates — see [Reporting Issues](/developer/contributing/reporting-issues.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.ipcheck.ing/developer/contributing/security-policy.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.