Security Policy

How HttpForge protects your data and how to report security vulnerabilities responsibly.

See also SECURITY.md on GitHub for vulnerability reporting guidelines.

Our Security Commitment

Security is integral to HttpForge, not an afterthought. As an API client that handles credentials and sensitive request data, we implement strong safeguards to protect your information at every layer.

Local-First Architecture

HttpForge stores all credentials, environment variables, and request data locally on your device. We do not operate cloud servers that store your API secrets. Your requests are sent directly to the endpoints you specify — HttpForge never proxies or logs your API traffic.

Credential Protection

  • Environment variables and tokens are encrypted at rest using AES-256 encryption
  • Encryption keys are derived from your operating system's secure credential store
  • Sensitive values are masked in the user interface by default
  • Exported collections strip credential values unless explicitly included

Open-Source Transparency

Our entire codebase is publicly auditable on GitHub. Security researchers and the community can review, verify, and improve our security practices.

Reporting a Vulnerability

If you discover a security vulnerability in HttpForge, please report it responsibly. Do not disclose the issue publicly until we have had an opportunity to address it.

Email: httpforge@outlook.com

Please include:

  • A description of the vulnerability and its potential impact
  • Steps to reproduce the issue
  • Affected versions, if known
  • Your contact information for follow-up

We aim to acknowledge reports within 48 hours and provide a remediation timeline within 7 business days.

Website Security Headers

The httpforge.com website is configured with HTTP security headers to reduce XSS, clickjacking, and MIME-sniffing risks:

  • Content-Security-Policy — restricts scripts, styles, fonts, and images to trusted sources
  • Strict-Transport-Security — enforces HTTPS for all future visits
  • X-Frame-Options — prevents the site from being embedded in iframes
  • X-Content-Type-Options — blocks MIME-type sniffing
  • Referrer-Policy — limits referrer data sent to third parties
  • Permissions-Policy — disables unused browser features (camera, microphone, geolocation, etc.)

Headers are defined in the site _headers file. CSP and Referrer-Policy meta tags provide additional protection on all pages.

Security Updates

Security patches are released as soon as fixes are verified. Critical vulnerabilities are communicated through GitHub releases and the project website.