Do not open a public issue for a security problem.

Report it privately through GitHub Security Advisories, or email security@livetennisapi.com.

Please include what you found, how to reproduce it, and what an attacker could do with it. We'll acknowledge within 72 hours and keep you updated until it's fixed.

In scope: the client libraries and tooling published by this organisation, and the api.livetennisapi.com service.

Out of scope: findings that require a compromised machine or a leaked API key you already control, rate-limit exhaustion of your own key, and reports generated by a scanner without a demonstrated impact.

Keys look like twjp_… and are bearer credentials — anyone holding one can spend your plan's quota.

• Keep keys in environment variables, never in source control.
• This package reads LIVETENNISAPI_KEY from the environment (or takes an explicit apiKey option) and never logs or transmits it anywhere except api.livetennisapi.com. The key is never included in tool results, so it cannot leak into a model conversation or provider logs.
• If a key is exposed, rotate it at https://livetennisapi.com.