Report a vulnerability.

How to report

Email security@ochk.io. You can also open a private security advisory on the relevant repository at github.com/orangecheck (opens in a new tab).

What happens next

• A reply. We aim to reply to every report within 30 days. We can’t promise a time to a fix yet.
• Disclosure once the fix ships. We publish an advisory and credit you, unless you prefer not to be named.
• Bounty: there is no paid bounty programme yet.

What’s in scope

• Spec flaws in any oc-*-protocol repo: an ambiguous canonical message, a replay path, a weight mode that rewards collusion, a hole in anchor checking.
• Bugs in our packages: any @orangecheck/* npm package, and the orangecheck Python package.
• Bugs in our sites: anything on ochk.io or its subdomains, and on ochk.app. For example: sign-in or session flaws, cross-site scripting, request forgery, SSRF, rate-limit bypasses, leaked secrets.
• Cryptographic bugs in the BIP-322, X25519, AES-GCM or OpenTimestamps code paths, including under unusual inputs.

Out of scope: chain analysis of proofs you chose to publish (that is the threat model, not a bug), social engineering of operators, and volume denial-of-service.

Threat models

Looking for what each protocol does and does not protect against? Start with the family-wide threat model in the docs. Every spec also has a SECURITY.md that says what the protocol proves, what it does not, and which attackers it is designed for. More on what we hold and store is on Trust.

Thank you for taking the time to make orangecheck safer.