OpenArcanum

Report a security issue

Please don't share a vulnerability publicly (in a community, an issue tracker or social media) until we have fixed it. Reports sent here go only to the maintainers.

Before you send one, read the security disclosure policy: what to include, when you'll hear from us, and our safe-harbour promise for good-faith research.

We reply by direct message in OpenArcanum, so we need your contact code. An e-mail address is optional.

One line: what is wrong, and where.

What an attacker can do, against whom, and what they need first (network position, membership, a malicious server…). Plain text only.

A proof of concept as text, if you have one.

For example "0.1.0, Windows 11".

How we reach you

In the OpenArcanum app (desktop or in your browser), open Direct messages → Contacts → Your contact code and copy it. It lets us message you without sharing a community, and works for about a week. A name in it is optional.

The anti-spam check needs JavaScript; it runs in your browser and sends nothing anywhere.

We keep reports encrypted on our server and use what you send only to handle your report.