If you believe you've found a security issue, report it privately so a fix can ship before public discussion. Do not open public GitHub issues for vulnerabilities.
Inspect the identity, follow the proof, and check the boundary before accepting an action.
Good reports minimize back-and-forth: a reproduction path, impact, and enough context for triage.
email · security@openagent.id
Email security@openagent.id. If your report is sensitive, keep details minimal until we confirm a secure follow-up channel.
Reference the repository and file paths if possible. Include the smallest reproduction that demonstrates impact.
goal · Triage-ready
These are targets, not guarantees. The goal is to acknowledge quickly, reproduce safely, and coordinate disclosure responsibly.
| Severity | Initial | Triage | Fix |
|---|---|---|---|
| Critical | Aim: 1 business day | Aim: 2 business days | Coordinate disclosure |
| High | Aim: 3 business days | Aim: 7 days | Coordinate disclosure |
| Medium | Aim: 7 days | Aim: 14 days | Coordinate disclosure |
| Low | Aim: 14 days | Best effort | Best effort |
We welcome good-faith security research. Please avoid privacy violations, data destruction, and service disruption.
Minimize harm
Out of scope
If you're reviewing the security model or threat vectors, start with the threat model and primitive choices.
