This package is pre-1.0 and moving fast. Only the latest published version on PyPI is supported with security fixes.
Please do not open a public GitHub issue for a security vulnerability.
Use GitHub's private vulnerability reporting instead:
- Go to the Security tab of this repository.
- Click Report a vulnerability.
- Describe the issue, including steps to reproduce and, if you have one, a suggested fix.
This opens a private advisory visible only to maintainers and you - it does not create a public issue.
We'll acknowledge a report within 5 business days and aim to have a fix (or a clear remediation plan) within 30 days for confirmed vulnerabilities, sooner for anything actively exploitable.
This SDK is a thin HTTP client - its attack surface is narrow, but a few things are genuinely security-relevant:
- Anything that could leak an API key (logging headers, including credentials in an error message or exception repr, sending the key somewhere it shouldn't go).
- A way to make a request bypass the
Authorizationheader entirely and still succeed. - A retry behavior that could replay a request with stale/wrong credentials, or send one request's data to the wrong recipient.
- A dependency-supply-chain issue in
httpxitself or in this package's own release pipeline.
Things that are not security issues, just bugs: a wrong type hint, a method that calls the wrong endpoint, a broken example. Please file those as regular issues instead.
- Secret scanning and push protection are enabled on this repository.
- Dependabot security updates are enabled.
mainis a protected branch - every change goes through CI and a code owner review before merging, including changes from maintainers.- Releases are published via PyPI Trusted Publishing (OIDC) from this repository's own CI - no long-lived publish token exists to leak.