Security disclosure.
Found a vulnerability in opchain? Thank you. This page is the contract for how to report it, what's in scope, and what to expect from us in return.
Report a vulnerability
Report vulnerabilities through GitHub's private vulnerability reporting — it opens a draft security advisory only you and the maintainers can see, and the whole lifecycle (triage, discussion, fix, credit) is tracked there as a GitHub security incident. We acknowledge within 3 business days.
Please don't open a public GitHub issue, file feedback through the on-site widget, or post on social before we've had a chance to triage and patch.
Visible only to you and the maintainers until a fix ships. Confirmed reports are published as GHSA advisories with credit to the reporter.
Alternative channels
No GitHub account, need PGP before sharing details, or does the report include user PII? Reach out directly:
- Email security@opchain.dev — ask for our PGP key in the first message; we'll exchange before you share details. Confirmed reports are mirrored into a GitHub advisory so tracking stays in one place.
Scope
opchain.devandstaging.opchain.dev(Cloudflare Worker + Astro site)- The opchain skill catalog under
skills/in the GitHub repo - The
/mcp,/api/health,/api/feedback,/api/notify,/api/votes, and/api/flags/publicendpoints - Build / supply-chain integrity of
opchain-skills.zip
- Vulnerabilities in Claude Code, Claude.ai, or Anthropic infrastructure — report those to Anthropic
- Third-party services we link to (Linear, PostHog, Cloudflare) — report directly to the vendor
- Denial-of-service or load testing — Cloudflare handles edge protection, please don't probe
- Social engineering, physical attacks, or anything requiring privileged access
- Self-XSS, missing security headers without an exploit, theoretical CSRF on unauthenticated endpoints
Safe harbor
Research conducted under this policy — good-faith, in-scope, non-destructive — is authorised. We won't pursue legal action against you for testing in line with this page, and we'll do our best to extend that protection if a third party intercedes.
If you're uncertain whether something is in scope or whether your plan is non-destructive, ask first.
What we ship in return
- Acknowledgment in the GitHub Security Advisory and on this page (if you want it)
- A fix. Critical issues patched within 7 days; high within 30
- A CVE when the finding warrants one
- opchain swag for unique, high-impact findings — once we have swag
opchain is a small open-source project. We don't have a paid bug bounty, but every confirmed report earns public credit and our gratitude.
security.txt
Machine-readable disclosure metadata perRFC 9116, served at/.well-known/security.txt.
Contact: https://github.com/ainatx/opchain/security/advisories/new
Contact: mailto:security@opchain.dev
Expires: 2027-08-26T00:00:00.000Z
Preferred-Languages: en
Canonical: https://opchain.dev/.well-known/security.txt
Policy: https://opchain.dev/security
Acknowledgments: https://github.com/ainatx/opchain/security/advisories
Acknowledgments: https://github.com/asfbay-bit/opchain-skills/security/advisories
Posture & hardening
Quick facts for anyone evaluating opchain for a regulated environment:
For a deeper threat model and infrastructure hardening review on your own systems, run theoc-security-auditorskill. How opchain.dev is built documents the stack this page describes.