Email support@rapidoddsapi.com. Please do not open a public issue.

Include what you found, how to reproduce it, and what an attacker could do with it. We will confirm receipt within a few business days.

Fixes go to the latest release.

Your key is passed as a query parameter, so it appears in URLs.

• Keep it server side. This package is built for Node and is not published for browsers, because bundling it into a page hands your key to every visitor.
• Load it from an environment variable or secret store, not a committed file.
• Regenerate it from your dashboard if it is ever exposed.