Security

How to report a problem, what the service does to limit harm, and how to check what it runs.

Report a vulnerability

Report it privately through GitHub's vulnerability form, or by email to [email protected] or [email protected]. Please do not open a public issue, do not test by overloading the service, and give time for a fix before you publish. The same policy is in security.txt and SECURITY.md.

How the service limits harm

• No accounts, no keys and no stored user data, so there is nothing of yours to leak.
• Datasets are opened read-only; no request can change them.
• Every client has a rate limit (600 requests a minute), request bodies are capped at 256 KB, and heavy work runs in a fixed number of slots, so a burst waits in line instead of exhausting the server.
• The network tools refuse private and reserved addresses, so they cannot be used to reach inside a network.
• The image endpoints draw from text alone and never fetch anything from an address you give.
• Personal values are kept out of logs and shared caches (see privacy).

Check the code

All of it is open source on GitHub. Every change runs the tests, Go's race detector, govulncheck against the Go vulnerability database and shellcheck before it can be released. OpenSSF Scorecard grades the repository's security practices every week, and Dependabot proposes dependency updates.

Verify a release

Each release is built by GitHub Actions from a public commit and carries a signed build provenance attestation. To check a downloaded bundle:

gh attestation verify dharun-api-linux-amd64.tar.gz --repo dharunashokkumar/api.dharun.dev
sha256sum -c dharun-api-linux-amd64.tar.gz.sha256

Using it safely

• Treat it like any outside service: set a timeout, handle errors, and cache answers you reuse.
• Format checks (GSTIN, PAN, IFSC) confirm the structure, not that the identifier was ever issued.
• Send only the personal data a task needs.