Report a vulnerability in the AstroWay API, the dashboard, the hosted MCP server or any package in this organisation by email to security@astroway.info. English or Ukrainian.

Please do not open a public issue for a security problem.

Include what you found, where (URL, endpoint or package and version), and the steps to reproduce it. If a request needs an API key, use a sandbox aw_test_* key, and never send someone else's key or personal data.

We confirm receipt, keep you informed while we fix it, and credit you in the release notes if you want to be named.

The machine-readable contact is at api.astroway.info/.well-known/security.txt. How we store and handle data: api.astroway.info/en/trust/.