Security

Routa takes vulnerability reports through private email rather than public issues, so a fix can ship before the problem is widely known. This page covers how to report one and which parts of an API Routa is responsible for.

Before You Start

• Do not open a public GitHub issue, discussion, or pull request describing the issue.
• Confirm the problem is in Routa itself rather than in an application built with it.

Steps

1. Email the report.

   security@routa-ts.dev

2. Include enough detail to reproduce and assess it.

   Include	Why
   Affected package or workflow	Narrows it to core, the CLI, or the scaffolder
   Routa version or commit	Determines whether it is already fixed
   Reproduction steps	Makes triage possible
   Impact	Sets severity
   Suggested mitigation	Optional, always welcome

3. Wait for acknowledgement before disclosing. The repository security policy describes the current process and timelines.

Verify

Check the sent message before disclosure. A complete report has a private recipient and enough evidence for the maintainers to reproduce the issue:

To: security@routa-ts.dev
Affected package or workflow: present
Routa version or commit: present
Reproduction steps: present
Impact: present

What Routa Secures

Routa owns the HTTP boundary, so these are Routa’s responsibility:

• Parsing and validating every declared input before a handler runs.
• Validating handler output against its declared schema before serialization.
• Not leaking internal error messages; runtime failures return generic problem documents.
• Refusing to overwrite files it does not track during scaffolding.
• Rejecting middleware it cannot statically verify.

What Your Application Secures

Routa makes security visible in the contract and in generated OpenAPI. It never implements any of it. These remain entirely yours:

• Authentication, credential verification, and session handling.
• Authorization rules and policy correctness. openapi.permissions is documentation, not enforcement.
• Secret storage and rotation.
• CORS policy. Routa answers preflights with the derived method list but never sets Access-Control-Allow-Origin.
• Rate limiting, request size limits, and denial-of-service protection.
• Transport security and anything the reverse proxy or platform in front of Routa provides.

Permissions are metadata

Declaring openapi: { permissions: ["users.read"] } on middleware documents a requirement in the generated contract. Your middleware run must still perform the check.

Troubleshooting

Problem	Fix
The issue may be in application code	Reduce the reproduction to Routa’s HTTP boundary before reporting it as a framework vulnerability.
The report contains secrets or production data	Replace them with synthetic values and revoke any credential that was exposed.
Email is unavailable	Do not disclose publicly; use the private contact method in the repository security policy when one is listed.
You have not received an acknowledgement	Follow up on the same private thread so context and attachments stay together.

Next Steps

MiddlewareWhere authentication and authorization attach.

Runtime behaviorError responses and CORS preflight handling.

ContributingNon-security changes go through the public process.