This repository hosts an unofficial Java client for the fernan.club API. The library and the upstream service are two different things, and security issues should be reported to the right party.

Examples of things worth reporting privately on this repo:

• A response payload from the upstream API that, when parsed by this library, triggers an unchecked exception in a way that callers can't recover from.
• A construct that allows a malicious baseUrl override to exfiltrate the API key (e.g. trusting non-HTTPS, opening to redirects, leaking the key in error text).
• A dependency CVE that affects users of this library at runtime.
• A way to bypass the explicit ReferralChoice requirement.

• API errors returned by the upstream service (cooldowns, rate limits, validation rejections). Those are normal behavior surfaced through FernanException.
• Account bans, refund denials, or other policy actions taken by fernan.club.
• Disagreement with how the upstream API works — that's an upstream concern.

We aim to acknowledge GitHub Security Advisories within 7 days and ship a fix within 30 days for confirmed library vulnerabilities. Severe issues will move faster. Once a fix is released, the advisory will be published with credit to the reporter unless they request otherwise.

Only the latest minor release receives security fixes. Older 0.x versions will not be backported; bump to the latest before reporting.