Only the latest release on the main branch receives security fixes. Older versions are not patched — please upgrade before reporting.

Do not open a public GitHub issue for security vulnerabilities.

Use GitHub's built-in private advisory flow:

Report a vulnerability →

This keeps the report confidential until a fix is released and lets us coordinate the disclosure timeline with you directly.

If you cannot use GitHub's advisory form, send a report to:

commercial@openosint.tech

Include:

• A clear description of the vulnerability
• Steps to reproduce (proof-of-concept code or commands)
• The component affected (CLI, MCP server, REPL, Web UI, a specific tool integration)
• The potential impact as you assess it

Encrypting your report is welcome but not required.

We will keep you informed at each step. If you have not heard back within 72 hours, follow up by email.

• Core framework (openosint/agent.py, openosint/pivot.py, openosint/correlation.py, etc.)
• Interactive REPL (openosint/repl.py)
• CLI (openosint/cli.py)
• MCP server (openosint/mcp_server.py)
• Web UI / FastAPI server (openosint/web_server.py)
• All tool integrations under openosint/tools/
• Dependency vulnerabilities that directly affect users of this package

• The public demo at demo.openosint.tech — it is a demonstration instance only. No sensitive personal data should be submitted there. Reports about behavior exclusive to the demo instance are noted but not treated as security vulnerabilities in the library itself.
• Third-party APIs (Shodan, VirusTotal, Censys, IP2Location, etc.) — OpenOSINT is a BYOK (bring your own key) tool. Your API keys are passed directly from your environment to the respective APIs and never touch OpenOSINT's servers. Vulnerabilities in those upstream services should be reported to those providers.
• Social-engineering attacks against maintainers
• Denial-of-service attacks against the demo instance

We follow coordinated responsible disclosure:

1. You report privately through one of the channels above.
2. We triage, develop a fix, and prepare a GitHub Security Advisory.
3. We coordinate a release date with you (typically within 90 days of the initial report).
4. We publish the advisory and release the patched version simultaneously.

Researchers who report valid vulnerabilities will be credited by name in the advisory unless they prefer to remain anonymous — just let us know your preference when you report.

OpenOSINT is maintained by Tommaso Bertocchi. The project is MIT-licensed and for authorized security research and educational use only.