ipapi.gr

Trust — Security

Found a vulnerability? Tell us first.

We'd rather hear about a weakness from you than from an attacker. This page explains how to report one, what's in scope, and how IPAPI.GR protects accounts and data.

Report

Email the security contact

Machine-readable contact details are published at /.well-known/security.txt.

Please include

  • The affected URL or API endpoint
  • Steps to reproduce, and what an attacker could achieve
  • The X-Request-ID response header and the time, if you have them
  • How we can reach you for follow-up

Never send passwords, full API keys or session cookies — yours or anyone else's.

Testing guidelines

In scope

  • The website and dashboard at ipapi.gr
  • The lookup API at fast.ipapi.gr
  • Sign-in, passkeys, API keys and billing flows on our side

Out of scope

  • Services run by third parties we use, such as Stripe or Google — report those to them
  • Denial-of-service and load testing
  • Social engineering, phishing or physical attacks
Please be careful

Use your own accounts and keys. Don't access, change or keep other users' data beyond the minimum needed to show the issue, don't flood the contact form or sign-up, and keep automated testing within the normal rate limits.

Safe harbour

Good-faith research is welcome.

If you make a good-faith effort to follow this policy while researching and reporting a vulnerability, we will treat your research as authorised. We will not pursue legal action against you, and we will not report you to law enforcement, for that research.

Good faith means staying within the scope and testing guidelines above, reporting the issue to us privately and promptly, and giving us a reasonable chance to fix it before you disclose it to anyone else. If you're unsure whether something is allowed, ask us first at [email protected].

This commitment covers only IPAPI.GR's own systems. It cannot authorise testing of third-party services, and it does not override the rights of other people whose data you might encounter.

No bug bounty. We don't pay rewards for reports. We're grateful for them, and we'll credit you publicly if you'd like.

Thanks

Hall of thanks.

Credit is opt-in. When you report a valid issue, tell us whether you'd like to be listed here, and under which name or handle, with an optional link. We add you once the issue is fixed. If you'd rather stay anonymous, we won't list you.

No acknowledgements yet.

How we protect you

Safeguards in the service.

The measures below are also described in the privacy policy.

Encrypted transport

The website and the API are served over HTTPS.

Passwords & passkeys

Passwords are stored as salted hashes. You can sign in with a passkey; we only ever hold its public key.

Sign-in protection

Sign-in throttling and temporary account lockout slow down password-guessing attacks.

Request forgery

Forms and account actions are protected against cross-site request forgery.

Rate limits

Per-account daily limits and request rate limiting keep the service predictable and limit abuse.

Minimal logging

IP addresses are redacted from application logs, which rotate daily.

Your part

Keeping your API keys safe.

  • Call the API from your server. A key in browser or mobile-app code can be read by anyone who loads it.
  • One key per app or environment. You can create up to 20 keys, each with its own description, so a leak only affects one integration.
  • Delete a leaked key. Deleting a key in Dashboard → API access stops it working immediately.
  • Turn on a passkey. It protects your account against reused or phished passwords.