If you find a security vulnerability in these examples, in an ETCH client library or in the ETCH service, report it privately by email to security@etch-labs.com.

Don't open a public issue or pull request about a vulnerability.

A useful report says what is affected (an example, a client library and its version, or the service), how to reproduce the problem, and what an attacker could do with it.

Never include an API key or a package token in a report, an issue or a pull request. If you think one of yours has been exposed, replace it from your ETCH dashboard: revoke the API key on the API keys page and create a new one, or regenerate the package token on the Integrations page, which stops the old token working within about a minute.