--- title: "Security disclosure - OkamiOps" description: "Responsible disclosure channel for vulnerabilities in okamiops.com and assets officially operated by OkamiOps." url: https://okamiops.com/security/ lang: en alternates: en: https://okamiops.com/security/ pt-BR: https://okamiops.com/pt/security/ de: https://okamiops.com/de/security/ x-default: https://okamiops.com/security/ lastmod: 2026-09-10 --- # Found a flaw? Tell us before you tell the world. okamiops.com/security/ · coordinated disclosure · RFC 9116 We're a security company: vulnerability reports get priority handling, a committed timeline, and no legal action against good-faith researchers. This page is our disclosure policy and a summary of what already protects this site. - [security@okamiops.com](mailto:security@okamiops.com) - [/.well-known/security.txt](https://okamiops.com/.well-known/security.txt) - **First response**: 3 business days to acknowledge receipt - **Fix window**: 90 days at most before coordinated disclosure - **Scope**: site + 8 okamiops.com, the API and the published products - **Safe harbor**: yes good-faith research never turns into legal action ## Four steps, no form and no bug-bounty platform. A well-written email beats a ticket. Tell us what you found, how to reproduce it and the impact. We handle the rest and keep you posted until it's closed. ### Email security@okamiops.com Subject starting with **[disclosure]**. If you'd rather encrypt it, ask for the PGP key at the same address and we'll send the key and fingerprint over a different channel. ### Include what lets us reproduce it Affected URL or component, steps, payload, request and response, product version, estimated impact and, if you have one, a proof of concept. Screenshots and video help; third-party data doesn't — stop at the first sign of it and tell us. ### Triage within 3 business days We confirm receipt, rate severity with CVSS 4.0 and agree on a timeline. You get a named point of contact and updates at every status change. ### Fix and coordinated disclosure We fix it, publish a note in the affected repository and credit the reporter, if they want credit. The maximum window is 90 days: past that, you may publish with or without our fix. /.well-known/security.txt · RFC 9116 ``` Contact: mailto:security@okamiops.com Policy: https://okamiops.com/security/ Preferred-Languages: pt, en, de Canonical: https://okamiops.com/.well-known/security.txt Expires: 2027-09-09T00:00:00.000Z $ curl -s https://okamiops.com/.well-known/security.txt ``` File published at the site root, in the format scanners and researchers already look for. ## What's in, what's out, and what we ask for in return. A clear scope protects both sides. What applies to our own systems doesn't apply to our clients' — those only come into scope with their prior written authorization. In scope ### Our own assets - okamiops.com, www and the product subdomains - The site's API: /api/lead, /api/baseline-unlock and the /api/\*.json feeds - The public repositories at github.com/OkamiOps - The eight published products, including Okami Tally on the App Store Out of scope ### What doesn't get triaged - Client systems, even ones we operate, without their written authorization - Denial of service, volumetric testing and brute force - Social engineering, phishing against the team and physical access - Raw scanner output without proof of exploitation, and "best practice" flags on SPF, DMARC or headers with no demonstrated impact Safe harbor ### The good-faith deal - You don't access, alter or keep data that isn't yours; if you find third-party data, you stop and tell us - You don't degrade the service or use the flaw beyond what's needed to prove it exists - You don't publish before the fix or the 90-day window, and you don't tie the report to payment - In return, we treat the research as authorized, don't pursue legal action and don't ask others to ## Headers you can check right now, with a curl. We don't ask you to trust us: the site is static, prerendered, served at the edge, with no third-party scripts and no trackers. Every response ships with this policy. - **Content-Security-Policy**: default-src 'self' · nonce-based script-src per response · no 'unsafe-inline' on scripts · connect-src 'self' · form-action 'self' · object-src 'none' - **Strict-Transport-Security**: 1-year max-age, includeSubDomains, preload - **X-Frame-Options**: DENY (frame-ancestors 'none') - **Referrer-Policy**: strict-origin-when-cross-origin - **Permissions-Policy**: camera, microphone, geolocation, payment and USB disabled - **Cross-Origin-\***: Opener-Policy same-origin · Resource-Policy same-origin · X-Content-Type-Options nosniff - **Fonts and scripts**: Everything served from our own domain. Zero third-party CDN, zero pixel, zero analytics. ### Forms with no database Contact, waitlist and download requests go out by email to our inbox. Honeypot against bots, origin verification and a size limit per field. Nothing is stored on the site. ### Token-gated downloads The free material is only served with a short-lived HMAC token issued after the form is submitted. No permanent link circulating. ### No cookies, no session There's no login and no session. The only thing the browser keeps is your language preference, locally. ### Tools for agents with a brake The WebMCP tools never take an action with side effects on their own: they fill in fields and return "awaiting human confirmation". ## In our products, the default is local-first: your data stays with you. The same rule we apply in consulting applies to what we publish. Every repository has its own security policy and takes fixes through the same channel as this page. Data ### No telemetry No product sends usage, prompts or code to OkamiOps servers. The apps only talk to the providers you connected. Secrets ### Keys in the Keychain In the macOS and iPhone apps, OAuth tokens and API keys live in the system Keychain, never in plain text. History is kept in local SQLite. Code ### Open for auditing Seven of the eight products have public code on GitHub. Product flaws are fixed in the repository with a release note and credit to the researcher. ## Security is a prerequisite, not a feature. If the flaw is in a client system we operate, tell us the same way: we forward it to whoever's responsible within 24 hours. Reports about this site and the products go straight into triage. [security@okamiops.com](mailto:security@okamiops.com) · [contato@okamiops.com](mailto:contato@okamiops.com) - [Report a vulnerability](mailto:security@okamiops.com) - [Need AppSec on your own product?](https://okamiops.com/servicos/consultoria/)