Security

How to report a security problem in searchcode.com or its hosted API, and what the hosted service handles.

Reporting a vulnerability

Email ben@boyter.org with “Security report” in the subject. Say what you found, how to reproduce it, and what you think it allows. A person reads every report and replies to it.

While you look, please:

• test against your own requests and data, never anyone else’s;
• keep load reasonable: no denial-of-service or volume testing against the live service;
• give us a fair chance to fix a problem before you publish it.

What is in scope

• searchcode.com: the website, including repository pages, search and the file view;
• api.searchcode.com: the hosted MCP server and REST API.

For the self-hosted product, searchcode enterprise, see its security documentation.

What the hosted service handles

• Public repositories only. It clones what a caller names from the public code host and analyses it. It refuses private repositories.
• No accounts. There are no passwords, sessions or stored credentials for callers.
• Request logs. Each API call is recorded for 90 days with its parameters and the caller’s network address, for abuse handling and capacity planning.
• Encrypted in transit. Both hostnames are served over HTTPS.

This policy is also published in machine-readable form at /.well-known/security.txt.