Tinplate 42 Edge APIs

Security Policy & Vulnerability Disclosure

Tinplate builds security and compliance micro-APIs. We welcome coordinated vulnerability reports from security researchers.

RFC 9116 /.well-known/security.txt

1. Reporting a Vulnerability

If you discover a security issue in any Tinplate endpoint, SSRF filter, or authentication check, please report it via our GitHub Security Advisories or security contact listed in /.well-known/security.txt.

Please include a minimal proof-of-concept request and the X-Request-Id header if applicable.
Do not test denial-of-service (DoS) or target third-party hosts through fetcher-backed endpoints.
We aim to acknowledge reports within 48 hours and deploy edge fixes within 7 days.

2. Core Security Controls

Constant-Time Auth Verification: Marketplace proxy secrets (X-RapidAPI-Proxy-Secret, X-Zyla-Proxy-Secret) are verified using constant-time HMAC/byte comparisons.
SSRF-Isolated Fetcher Worker: Outbound HTTP calls run in a separate Worker (edgeguard-fetcher) with zero access to Gateway secrets, blocking RFC1918, loopback, link-local, CGNAT, and cloud metadata IPs at every redirect hop.
Zero Payload Retention: Worker invocation logging and Analytics Engine are disabled in configuration.