Security

Last updated October 7, 2026

Keeping your preferences safe is central to OpenPrefs. If you believe you have found a security vulnerability, we want to hear about it.

Reporting a vulnerability

Email security@openprefs.ai with a description of the issue, the steps to reproduce it, and its impact as you understand it. Please do not report security issues through public channels.

Scope

openprefs.ai and its subdomains, including the API and MCP endpoints, and the OpenPrefs web app.

Guidelines

When researching, please:

• test only against accounts you own or have permission to use, and never access, change, or delete other people’s data;
• stop and report as soon as you can show an issue, without going further than needed to demonstrate it;
• avoid degrading the Service: no denial-of-service testing, spam, or high-volume automated scanning;
• give us reasonable time to fix an issue before disclosing it publicly.

Our commitment

If you follow these guidelines and act in good faith, we will not pursue legal action against you for your research, we will work with you to understand and resolve the issue, and we will keep you informed of our progress.

Our machine-readable contact details are in /.well-known/security.txt.