Security Policy

Reporting a vulnerability

Please report security issues privately through GitHub's private security advisories. Do not open a public issue for a suspected vulnerability.

Include enough detail to reproduce the problem: the URL, the steps, and what you expected to happen. We will acknowledge the report and keep you updated as we investigate.

Scope

In scope:

• The Spotistats web app at spotistats.otbeaumont.me and its API.
• The source in this repository, including the worker.
• Authentication and session handling, including the listening-stats OAuth flow.
• Access to another user's stored listening history or tokens.

Out of scope:

• Spotify's own services and APIs.
• Denial of service, spam, or automated traffic against the hosted site.
• Reports from automated scanners without a concrete, exploitable finding.

Please don't

• Access, change or delete data that is not yours.
• Run destructive tests against the hosted service.
• Use social engineering, or target the Spotify accounts of others.

Machine-readable policy

The standard security contact file is served at /.well-known/security.txt.