Security and disclosure

Report privately

Use GitHub private vulnerability reporting. If the form is unavailable, email 0xcircuitbreaker@protonmail.com. For website issues, name opentine.com in the report.

Include the affected version or commit, reproduction steps, environment and whether a harness or provider was involved. Do not post secrets or private run artifacts in public issues.

Disclosure process

The project handles reports on a best-effort basis. The core policy asks reporters to expect acknowledgement within seven days; no fix timeline is promised. If no acknowledgement arrives within fourteen days, try the fallback channel and use your judgement about disclosure. Coordinate publication with the maintainer when possible.

Only the latest core release receives fixes; older 0.x releases have no backports. The historical version table in the pinned SECURITY.md is stale; its latest-release policy applies.

Core security policy · Security model · security.txt.

Verification boundaries

Integrity and signatures authenticate recorded bytes and claims. They do not sandbox third-party agents or establish that model output is safe to execute. Hosted security and operational details will be published before opentine-web launches.