Security
How we protect your account, and how to report an issue
1. Account Security
- Passwords are never stored in plain text — they're hashed with bcrypt before being saved.
- Sessions use signed tokens (JWT) over an HTTPS-only cookie.
- Email/password sign-ups require email verification before the account can be used.
- You can optionally restrict your API key to a whitelist of specific IP addresses from your Dashboard.
2. API Protection
- Every request is served over HTTPS.
- Endpoints are rate-limited per key and per IP to prevent abuse.
- Repeated abusive traffic to an endpoint can trigger an automatic temporary block.
- Daily request quotas apply to free-tier keys; Premium keys are unlimited but still subject to abuse protection.
3. Infrastructure
Malvin API runs on Vercel's serverless infrastructure, with data stored in MongoDB Atlas. Both providers maintain
their own independent security and compliance programs for the infrastructure layer.
4. Responsible Disclosure
If you believe you've found a security vulnerability in Malvin API, please report it privately before disclosing it publicly. When reporting, please include:
- A description of the vulnerability and its potential impact.
- Steps to reproduce it.
- Any proof-of-concept code or requests, if applicable.
Please don't access, modify, or delete data that isn't yours while investigating an issue, and give us a
reasonable amount of time to fix a confirmed issue before disclosing it publicly.
5. What's Out of Scope
The following aren't considered security vulnerabilities on their own:
- Rate limiting or daily quota behavior.
- Missing security headers with no demonstrated impact.
- Reports generated purely by automated scanners without a working proof-of-concept.