Report vulnerabilities privately through GitHub: Security > Report a vulnerability. Please do not open a public issue for anything exploitable.

Expect an acknowledgement within a week. Fixes ship as a patch release, and the advisory is published once the fix is out.

oc fetches untrusted web pages by design, so the interesting bugs are the ones where page content escapes its role as data: rendered text that can alter what an agent executes, URLs that reach private or internal hosts despite the SSRF guard, or a crafted page that breaks the distiller. Bugs in the experiments/ directory are out of scope; nothing there ships in the package.

Only the latest release on npm is supported. There is no backporting; a security fix means a new release.