OpenTradeIntel is pre-1.0 software. Security fixes are applied to the latest released minor line.

Please do not disclose suspected vulnerabilities in a public issue, discussion, or pull request.

Use GitHub's Report a vulnerability flow on the repository Security page. Include the affected version, reproduction steps or proof of concept, impact, and any suggested remediation. If private vulnerability reporting is unavailable, contact the maintainer through the private contact method listed on the maintainer's GitHub profile and avoid including exploit details in public channels.

The maintainer will acknowledge a complete report when capacity permits, validate its scope, coordinate a fix and release, and credit reporters who request attribution. This is a volunteer open-source project and does not promise a fixed response SLA.

The project does not collect telemetry or call external AI services by default. Operators are responsible for authentication in front of the API, network exposure, source-data authorization, retention, backups, and dependency updates. OpenTradeIntel matching output is decision support, not a substitute for procurement, legal, sanctions, quality, or security review.