The public site boundary
MinerAPI.com serves documentation, illustrations, sample client files, and deterministic JSON fixtures. It does not request wallet access, hold account credentials, or accept private prompt data. Demo controls fetch public resources from the same website origin.
The boundary for your implementation
A real device collector or model-execution service belongs in an authorized environment with appropriate access controls. Do not place private credentials in HTML, client-side JavaScript, sample downloads, or public logs. Observation access and administrative authority should be designed separately.
The full security guide discusses object-level authorization, bounded requests, safe errors, and uncertain action outcomes. Treat those patterns as a starting point for your own threat model rather than a claim that copying an example establishes production security.
Reporting a concern
Email [email protected] with the affected public URL and a safe description of the issue. Do not include private keys, live tokens, confidential personal information, or sensitive device configuration in the initial message. Limit testing to systems you own or are explicitly authorized to assess.
Keep diagnostic evidence safe
A sanitized reproduction is often enough to identify a broken example or unsafe output. Avoid forwarding entire upstream responses when only one field is relevant. Review screenshots, exception messages, and downloaded logs for secrets before sharing them.