OpenScan.AI operates explorer infrastructure for the XDC Network and other EVM chains. We take the security of our platform — and the safety of the researchers who help us improve it — seriously. This policy explains what to report, how to report it, and what you can expect from us.
Scope: what to report
We welcome vulnerability reports affecting the systems we operate:
- The explorer frontend — xdcscan.io and its testnet instances, including XSS, CSRF, and injection issues.
- The REST API v2 — xdcscan.io/api-docs, including authentication bypasses, data exposure, and rate-limit or abuse weaknesses.
- This website and documentation — openscan.ai content, docs, and the flows they link to.
- Open-source code — vulnerabilities in repositories under github.com/OpenScanAI.
Out of scope: vulnerabilities in the XDC protocol itself, third-party services we link to, social engineering, physical attacks, and denial of service testing against production infrastructure. Spot a scam or phishing listing instead? Use the report-abuse flow on the support page.
How to report
Submit your report through our contact form with the subject line starting with "Security:". Please include:
- A clear description of the vulnerability and its impact.
- Steps to reproduce, including URLs, request/response samples, or proof-of-concept code where possible.
- The affected surface (explorer, API, website, or repository).
- Your name or handle if you'd like recognition.
Please do not disclose the issue publicly until we have had a reasonable opportunity to investigate and remediate it.
Our commitment
- Acknowledgement: we aim to acknowledge reports within 3 business days.
- Assessment: we aim to provide an initial severity assessment and remediation plan within 10 business days.
- Resolution: we will keep you informed of progress and credit you (with your permission) once the fix is deployed.
Recognition
We do not currently operate a paid bug bounty program. Researchers who report valid, previously unknown vulnerabilities are credited in our release notes and security acknowledgements (unless they prefer to remain anonymous), and receive our genuine thanks — responsible disclosure makes the whole ecosystem safer.
Safe harbor
We consider security research conducted under this policy to be authorized and good-faith. If you make a reasonable effort to comply with this policy, we will not pursue or support legal action against you, and we will work with you to understand and resolve the issue quickly. Specifically:
- Only test against your own accounts and data; never access, modify, or exfiltrate data belonging to others.
- Stop testing and report immediately if you encounter user data or sensitive information.
- Do not degrade the service for other users — no denial-of-service testing, spam, or destructive payloads against production systems.
- Give us a reasonable time to remediate before any public disclosure.
If third-party safe-harbor terms apply to your jurisdiction, this policy is intended to be read consistently with them.
Open-source transparency
OpenScan.AI is built on an open-source stack. You can review the code, audit it, and report issues directly at github.com/OpenScanAI. For sensitive reports, prefer the contact form over public GitHub issues so we can coordinate disclosure.