Do not open a public issue for a security problem.

Report it privately through GitHub Security Advisories, or email security@livetennisapi.com.

Please include what you found, how to reproduce it, and what an attacker could do with it. We'll acknowledge within 72 hours and keep you updated until it's fixed.

In scope: the client libraries and tooling published by this organisation, and the api.livetennisapi.com service.

Out of scope: findings that require a compromised machine or a leaked API key you already control, rate-limit exhaustion of your own key, and reports generated by a scanner without a demonstrated impact.

Keys look like twjp_… and are bearer credentials — anyone holding one can spend your plan's quota.

• Keep keys in environment variables, never in source control.
• The official clients read LIVETENNISAPI_KEY from the environment and never log or transmit it anywhere except api.livetennisapi.com.
• The WebSocket feed passes the key as a query parameter, because the browser WebSocket API cannot set request headers. It is encrypted in transit under TLS, but query strings can be recorded in server logs — prefer a separate key for streaming if that matters to you.
• If a key is exposed, rotate it at https://livetennisapi.com.