Security Policy

OCP is a security protocol (delegated pairing, proof-of-possession tokens, human-approval gates). We take reports seriously.

Please do not open public issues for vulnerabilities. Report privately to [email protected] with a description, impact assessment, and reproduction. You will receive an acknowledgement within 72 hours. Coordinated disclosure preferred; we credit reporters unless asked not to.

In scope: the protocol design (SPEC/), the contracts and vectors (ocp-protocol), the client packages (ocp-companion, ocp-embed). Implementations built on OCP have their own policies.