If you discover a security vulnerability in Snipepy, please report it privately. Do not open a public Codeberg issue.

Contact the maintainer directly via the email address listed on their Codeberg profile. Include:

• A clear description of the issue
• Steps to reproduce
• Potential impact
• Any suggested fix if you have one

You can expect an acknowledgement within 72 hours and a resolution or status update within 14 days.

Snipepy authenticates to SnipeIT using a Bearer token.

Rules:

• Store the token in an .env file or a secrets manager. Never write it in source code.
• The .env file must not be committed to version control. It is already listed in .gitignore.
• Do not log the token or include it in error messages.
• Rotate the token if it is accidentally exposed.

In code: always read credentials from the environment:

import os
token = os.environ["SNIPEPY_API_TOKEN"]

SNIPEPY_VERIFY_SSL defaults to false. This default is intentional for local development against self-signed certificates. Always set SNIPEPY_VERIFY_SSL=true in any environment that handles real data.

Accepted truthy values: true, 1, yes (case-insensitive). Any other value is treated as false.

Disabling SSL verification exposes credentials and response data to man-in-the-middle attacks. Never disable it in production.

Snipepy keeps runtime dependencies minimal on purpose. Fewer dependencies mean a smaller attack surface.

Runtime dependencies:

• requests>=2.28.0: HTTP client
• pydantic>=2.0.0,<3.0.0: response validation
• python-dotenv>=1.0.0: .env file loading

Before adding a new dependency:

1. Check whether the standard library already covers the need.
2. Verify the package is actively maintained and has no known critical CVEs.
3. Pin to a minimum version (>=) rather than an exact version to allow security patches.

Only the latest release receives security fixes. Upgrade to the current version before reporting an issue.