Report vulnerabilities through OpenSea's Bugcrowd program:

https://bugcrowd.com/engagements/opensea

OpenSea's security team monitors that program, and every report is triaged and tracked there. Do not open a public GitHub issue, discussion, or pull request about a vulnerability, and do not disclose it publicly until the program has responded.

The Bugcrowd brief defines what is in scope, what is excluded, how severity is assessed, and how rewards work. This file does not repeat any of it, because a second copy would drift from the brief. Read the brief before you start.

The program sets response and disclosure timelines, not this repository.

@opensea/api-types is TypeScript types generated from the OpenSea API's OpenAPI spec. Its only runtime code is a few generated constants (CHAIN_IDENTIFIERS, AUTH_SCOPES) and the isChainIdentifier guard, so a finding here is usually a type that misdescribes what the API returns and leads a consumer into unsafe handling. Vulnerabilities in the API itself fall under the Bugcrowd brief's scope, not this repository.

This repository is a read-only mirror of a private OpenSea monorepo. Fixes arrive here as synced commits, not merged pull requests, so a missing PR does not mean a missing fix.

• Test against production. Do not run exploit attempts against opensea.io, api.opensea.io, or any other OpenSea-operated service. Reproduce against a local build, a testnet, or your own deployment.
• Run automated scanners, fuzzers, or crawlers against opensea.io or the OpenSea API. That traffic looks like an attack and gets blocked, and raw scanner output is not a report on its own.
• Touch accounts, wallets, or data that are not yours. Use your own.
• Attempt denial of service, spam, or social engineering against OpenSea staff, users, or infrastructure.

We cannot accept a finding that required breaking one of these rules, however real the underlying bug is.