Security
How Timewell handles data and how to report a vulnerability or abuse.
Transport
The site and the API are served over TLS 1.2 or 1.3 only, with HSTS. Plain HTTP requests are redirected.
Data
The API is stateless and stores no user data. Responses are computed from the bundled time zone database.
Abuse
Clients that ignore rate limits or cache headers may be blocked. Report abuse to abuse@api-eu.rooni.dev.
Reporting a vulnerability
Email security@api-eu.rooni.dev. We reply within two business days and do not take legal action against good-faith research. Contact details are also in security.txt.