Security and responsible disclosure

If you believe you have found a security problem in ListingView, please tell us privately first. We review every report.

How to report

Write to support@listingview.io with "Security" in the subject. Please include:

• what you found and where (the URL, route or CLI command);
• steps to reproduce it, and the request_id of a request that shows it (every API response carries X-LV-Request-Id);
• what an attacker could do with it.

Never send a real API key, password or another person's data in a report. If you find a ListingView API key in public (it starts with lv_live_ or lv_test_), tell us where — we will revoke it.

In scope

• The public API (/api/v1), the MCP server (/mcp) and the listingview CLI.
• The ListingView web app and browser extension.

Out of scope

• Denial of service, load or volume testing, and spam.
• Social engineering, phishing and physical attacks.
• Etsy, Printify and other third-party services — please report those to their owners.

Rules for testing

• Use only your own account. Prefer a lv_test_ key: every change it makes is a dry run.
• Never access, change or delete another seller's data. If you reach data that isn't yours, stop, don't keep it, and tell us.
• Don't run automated scanners that degrade the service for other sellers.
• Give us a reasonable time to fix the problem before you share it with anyone else.

What we do

We will confirm that we received your report, keep you updated while we work on it, and tell you when it is fixed. We will not take legal action against good-faith research that follows these rules.

Machine-readable contact: security.txt (RFC 9116).