If you discover a security vulnerability in this project, please report it responsibly.

Do NOT open a public GitHub issue for security vulnerabilities.

Instead, please report it via GitHub's private vulnerability reporting at https://github.com/MPCoreDeveloper/SharpToyotaClient/security/advisories/new with:

• A description of the vulnerability
• Steps to reproduce the issue
• Any potential impact
• Suggested fix (if you have one)

• Acknowledgment within 48 hours of your report
• Assessment of the vulnerability within 1 week
• Fix and disclosure coordinated with you

This library handles authentication tokens for the Toyota Connected Services API. Contributors and users should be aware of:

• Never commit credentials — Use environment variables or secure file storage
• Token caching — Cached tokens contain access and refresh tokens. The default cache file (toyota_credentials_cache_contains_secrets.json) should be added to .gitignore
• SSL validation — The client has an option to bypass SSL validation for development. Never use this in production
• API keys — The client ships with a built-in public OneApp client identifier (Constants.PUBLIC_API_KEY). It is a publicly distributed key used by the Toyota OneApp mobile application and is not a credential; the SonarCloud S6418 finding is explicitly suppressed with justification in the source. To rotate or override it, set the ToyotaApi:ApiKey configuration section or the TOYOTA_API_KEY environment variable

1. Store credentials in environment variables, not in code
2. Add token cache files to .gitignore
3. Use short-lived tokens when possible
4. Do not log full access tokens in production
5. Keep the library updated to the latest version