Security

API keys

• Keys are vk_live_ / vk_test_. Only a SHA-256 hash is stored — plaintext is shown once at creation.
• Send keys server-side via the X-API-Key header. Never ship a key in client-side/browser code.
• Rotate keys anytime; revoke a leaked key from your dashboard (or DELETE /v1/admin/keys).

Admin token

Key management (/v1/admin/keys) is gated by a separate X-Admin-Token, kept server-side. If it's unset, the admin API is disabled entirely.

Transport

• All traffic is over HTTPS/TLS. Requests over plain HTTP are rejected.

Data handling

• Vector returns public data and cites sources; it does not store the bodies it fetches beyond your response.
• Usage metadata (endpoint, timestamp, counts) is logged for rate-limiting and abuse prevention. See the Privacy Policy.

Reporting

Found a vulnerability? Please contact us privately before disclosing — we'll respond quickly.