Security
OASA is built around encrypted links and secure defaults. If you find a weakness, we want to hear about it.
Draft policy. Last updated 2026-10-20. It will be reviewed as OASA grows.
Report a vulnerability
Email security@joinoasa.org. Please include:
- What you found and where.
- Steps to reproduce it.
- What you think the impact is.
- How to reach you, if you want a reply.
In scope
- joinoasa.org
- OASA's GitHub repositories, published designs and firmware, once they exist
Out of scope
- Third-party platforms we use. Report those to the platform.
Ground rules
- Don't access other people's data.
- Don't degrade the service.
- Give us time to fix the issue before you publish it.
Good-faith research is welcome.
What happens next
- Acknowledgement. We will confirm we received your report.
- Triage. The Security council reviews it. During the founding phase, the founder does.
- Fix. We fix the issue and test the fix.
- Credit. If you want credit, we'll name you.
We don't offer paid bounties yet.
How we work
These are the rules we are setting up for ourselves:
- Two-factor authentication for every member.
- Hardware security keys for Leads, Core members and contract staff.
- Code review and signed releases for official projects.
- Dependency and secret scanning.
- Firmware signing, so devices only run trusted code.