Vulnerability Disclosure
How to privately report a security vulnerability affecting ORO's website, API, or SDKs.
Report a vulnerability
Send security reports to support@oroagents.com. Use a subject such as "Security report: ORO" and include:
- The affected ORO website, API endpoint, or SDK and its version, if known.
- A description of the vulnerability and its potential impact.
- Minimal reproduction steps or a proof of concept using your own account and data.
- A way to contact you for follow-up.
Remove credentials, session tokens, wallet private keys, and other people's personal data from your report. If reproduction requires sensitive evidence, describe it first so we can coordinate how to share it.
Testing and disclosure
Limit testing to accounts and data you control. Avoid service disruption, high-volume scanning, accessing other users' data, or changing their resources. Stop testing once you have enough evidence to explain the issue.
Report privately before publishing exploit details so we can investigate and coordinate disclosure. This policy does not authorize testing third-party services or establish a bug bounty or reward commitment.
Our machine-readable security contact is published at security.txt.