Security Research and Vulnerability Disclosure Policy

OceanAlt welcomes good-faith researchers who help find API security issues, authorisation bypasses, Agent attribution flaws, replay, weaknesses in pre-payment risk controls, and privacy or data-leak issues.

To the extent permitted by law, where a researcher acts in good faith, follows this policy, causes no actual harm to users or third parties, does not steal, publish or misuse data, does not extort, and reports promptly, OceanAlt will in principle not seek civil remedies solely for that good-faith research and will treat it as authorised security research. This safe harbour does not authorise testing of third-party systems.

DoS/DDoS; large-scale automated scanning that degrades service; social engineering; phishing staff or users; accessing unrelated personal data; moving real assets; modifying or deleting production data; attacking third-party RPCs, wallets, facilitators or data sources; publishing exploitable details before OceanAlt has had reasonable time to fix.

Report security issues to business@oceanalt.com (a dedicated security mailbox will be listed here once live). Include: impact, reproduction steps, request/response, risk explanation, whether real funds or personal data are involved, and a suggested fix.

OceanAlt will make reasonable efforts to acknowledge receipt, assess impact and provide progress in due course. High-risk payment, funds or credential issues are prioritised. No fixed SLA is promised.

OceanAlt's only official website is oceanalt.com. We send email only from addresses ending in @oceanalt.com, and the domain publishes SPF and DMARC. A message whose display name says "oceanalt.com" but whose actual address is on another domain did not come from us.

We never ask you to verify or confirm your email address through a link, never ask for your mailbox password, seed phrase, private key or API key, and never ask you to connect a wallet to unlock, verify or claim anything. Lookalike domains that differ by a letter or two are not ours.

If you receive a suspicious email, site or account, do not click its links; forward the original message to business@oceanalt.com. OceanAlt is not responsible for losses caused by emails, websites or accounts that OceanAlt does not operate.