Reporting a vulnerability

We hold access to other people’s code, so we hold ourselves to a higher bar than the apps we audit. If you find a security issue in OpenKeel, please tell us before anyone else.

How to report

Email security@openkeel.dev with steps to reproduce and the impact you saw. We reply within two business days and keep you updated until it’s fixed.

Please don’t

• Access, change or delete data that isn’t yours
• Run denial-of-service or automated volume testing
• Test against clients’ apps; they’re out of scope

Our commitment

We won’t take legal action against good-faith research that follows this policy, and we’ll credit you if you’d like. Findings in a client’s app are never shared outside that engagement.