Report vulnerabilities through OpenSea's Bugcrowd program:

https://bugcrowd.com/engagements/opensea

OpenSea's security team monitors that program, and every report is triaged and tracked there. Do not open a public GitHub issue, discussion, or pull request about a vulnerability, and do not disclose it publicly until the program has responded.

The Bugcrowd brief defines what is in scope, what is excluded, how severity is assessed, and how rewards work. This file does not repeat any of it, because a second copy would drift from the brief. Read the brief before you start.

The program sets response and disclosure timelines, not this repository.

@opensea/cli is a command-line client for the OpenSea API that also wraps the SDK. It reads and writes credentials on the user's machine, runs local processes, and can sign and send transactions for the user.

It moves assets. Look first at credential storage and file permissions, command construction, and any path that turns attacker-influenced input into a local command or a signed transaction.

This repository is a read-only mirror of a private OpenSea monorepo. Fixes arrive here as synced commits, not merged pull requests, so a missing PR does not mean a missing fix.

• Test against production. Do not run exploit attempts against opensea.io, api.opensea.io, or any other OpenSea-operated service. Reproduce against a local build, a testnet, or your own deployment.
• Run automated scanners, fuzzers, or crawlers against opensea.io or the OpenSea API. That traffic looks like an attack and gets blocked, and raw scanner output is not a report on its own.
• Touch accounts, wallets, or data that are not yours. Use your own.
• Attempt denial of service, spam, or social engineering against OpenSea staff, users, or infrastructure.

We cannot accept a finding that required breaking one of these rules, however real the underlying bug is.