Security Policy
How we handle vulnerabilities, authentication, and responsible disclosure.
Reporting a Vulnerability
Email security@superinstance.ai or open a private security advisory at github.com/SuperInstance/SuperInstance/security.
Please do not publicly disclose vulnerabilities before we've had a chance to respond.
Response Time
- Acknowledgment: within 48 hours
- Initial assessment: within 5 business days
- Fix:
- Critical — 24 hours
- High — 72 hours
- Medium — 2 weeks
- Low — next release
API Authentication
| Endpoint | Auth Required | Method |
|---|---|---|
POST /search | No | — |
POST /recommend | No | — |
POST /similar | No | — |
GET /stats | No | — |
GET /clusters | No | — |
GET /docs | No | — |
GET /openapi.json | No | — |
POST /ingest | Yes | Authorization: Bearer <token> |
Only /ingest requires authentication. All read endpoints are public and free.
Getting an Ingest Token
Contact security@superinstance.ai or open a GitHub issue to request an ingest token.
Rate Limiting
Public endpoints are currently unrate-limited for development. We ask that you:
- Keep requests under 10/second sustained
- Use
topK ≤ 20for search queries - Cache results locally
Abuse will result in IP-level blocking. Production rate limits coming soon.
Scope
In Scope
Fleet Vector API, superinstance.ai, npm packages (@superinstance/*), GitHub repos
Out of Scope
Social media, third-party services, DoS attacks, social engineering
Best Practices
- Never share API tokens in public repos
- Use environment variables for credentials
- Pin npm package versions in production
- Report unexpected behavior