Security.

Amanoki is a read-only HTTP API for wholesale electricity markets — JEPX regime labels, spike probabilities, forecast distributions, and the Japanese fuel-cost adjustment. Every public endpoint is an anonymous GET: a caller sends a URL and receives JSON, computed from published market and government data. Exactly what a request leaves behind is set out under Data collected below — route-level counters, and an error trace when something fails with a 5xx.

That shape is what most of the posture below follows from, and it is what a security review is usually trying to establish. This page sets out the specifics for anyone whose review needs them written down: transport and TLS, the response headers, the error format, how the operator-only endpoints behave, the authentication position today, what is recorded and for how long, which third parties are in the path, and how to report something.

Transport

• HTTPS only on amanoki.com and api.amanoki.com.
• HSTS max-age=31536000; includeSubDomains; preload.
• TLS terminated at Cloudflare (landing) and Fly.io (api); certificates managed by each platform.

Headers

• Content-Security-Policy: default-src 'self'; script / style / image / connect restricted; frame-ancestors 'none'.
• X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: strict-origin-when-cross-origin.
• Permissions-Policy: geolocation / microphone / camera / payment all denied.

Errors

All non-success responses ship as application/problem+json (RFC 7807) with {type, title, status, detail, instance}. The type URI points at the methodology section that explains the relevant problem class.

Admin surface

Admin endpoints (e.g. /v1/admin/usage) require a bearer token (AMANOKI_METRICS_TOKEN). When the token is unset, or the bearer doesn't match, the endpoint returns 404 Not Found with no hint that the endpoint exists.

One route under that prefix is deliberately open: /v1/admin/model-performance, which returns the serving model's held-out Brier scores and is what /stats renders. Those scores ship inside the same image the public endpoints serve, so gating them would protect nothing. It is grouped under /v1/admin/ for routing rather than for access control, and it is the only exception.

Authentication

Public endpoints are currently callable without an API key. When paid tiers open, keys will be issued through the billing flow; rate limits and tier gating will apply.

Data collected

• Request route, status code, and timestamp for rough usage counters (/v1/admin/usage, in-memory only, restart-cleared).
• No personally identifiable information is stored for anonymous callers.
• No request bodies, no query parameters, no user agents retained beyond the in-process counter snapshot.
• Error telemetry (Sentry) captures stack traces and HTTP status; 4xx responses are dropped before send, and per-fingerprint bursts are rate-limited.

Third parties

• Fly.io — application hosting (nrt region).
• Cloudflare Pages — static landing hosting.
• Open-Meteo — weather data input, no credentials, no PII sent.
• Sentry — error telemetry (DSN optional; disabled until configured).

Reporting

There is no vulnerability-disclosure address yet. One opens alongside the billing flow.