Security

[SCH227]

Hey, first of all, awesome project!

I wanted to report two security-related issues:

• API_URLS are all over HTTP. An attacker in a MITM position would be able to read everything between client-server, for example, the api-key
• The repo lacks a SECURITY.md, or any channel where these type of issues can be reported privately

[g147]

Hello! Thanks for bringing it to our attention. We'll fix it ASAP!

[g147]

Issued an advisory: https://github.com/ARPSyndicate/puncia/security/advisories/GHSA-rwcj-7jjp-4w38 Fixed the issue: https://github.com/ARPSyndicate/puncia/commit/033f3b68126eabbb2040ce16e2c3a2ce17437fbd

[SCH227]

Thank you for the quick response and again, for the awesome project!