Email security@openseo.so. Do not open a public GitHub issue, discussion or pull request for a security problem.

In scope:

• The code in this repository.
• The hosted service at app.openseo.so and the website at openseo.so.
• Self-hosted deployments running this code.

Out of scope:

• Third-party services OpenSEO calls (DataForSEO, Google, Autumn, OpenRouter and others). Report those to the vendor.
• Misconfiguration of a self-hosted deployment.
• Denial of service, load testing, and reports that only point out a missing rate limit.
• local_noauth mode has no login by design. Run it behind your own auth.

• The affected URL, route, MCP tool or file.
• The account role and organization you used, and the deployment mode (hosted, cloudflare_access or local_noauth).
• Exact steps or requests to reproduce.
• What you were able to read, change or spend.

• We acknowledge reports within a few business days.
• We fix confirmed issues and credit you in the fix unless you ask us not to.
• There is no bug bounty program.

We will not take action against good-faith research that stays within this policy. That means:

• Use only accounts and data you own.
• Don't spend credits you didn't pay for.
• Don't drain the free tools' daily budget.

The threat model explains how we rate severity and lists the intended behaviors we do not treat as bugs.