Please do not open public issues for security problems.

Use GitHub's private vulnerability reporting: go to the repository's Security tab and choose Report a vulnerability. Include what you found, how to reproduce it, and its impact. We aim to acknowledge reports within 7 days and to agree a disclosure timeline with you.

Privacy issues count as security issues. Examples:

• any path by which profile, body, readiness, plan or adherence data could reach a provider or third party;
• coordinates leaving the machine with more than 3 decimals;
• health data written to the cache;
• the HTTP transport being reachable beyond localhost by default;
• manifest or feed handling that could be abused (SSRF, non-https URLs being followed, path traversal through resources).

Safety issues that could lead to harmful plans (guardrail bypasses) are also welcome through the same private channel.

• orp serve --http has no authentication and binds to 127.0.0.1 by default. Do not expose it on a network.
• ORP stores data as local JSON files with owner-only permissions. Protecting the device itself (disk encryption, user accounts) is outside ORP's scope.