Back to Hub

Contact Us

One mailbox handles product feedback, factual corrections, support questions and security reports.

Email

Read by the independent operator of OpsecForge, with AI assistance.

admin@opsecforge.com

What to send

  • A factual error in an article or a tool's behavior. Include the page URL and, if you can, the primary source that shows the correct answer. Confirmed errors are recorded on the corrections page.
  • A bug report: the tool, your browser, and the steps to reproduce it with synthetic input.
  • Questions about the tools, the MCP server or the editorial policy.

What not to send

  • Real secrets. Do not include live passwords, API keys, tokens, private keys, signing secrets, or real customer or personal data in an email, even if the problem involves them. Replace them with invented values that have the same shape.
  • Attachments you have not scrubbed, or logs with credentials in them.
  • Requests for security audits, penetration tests, or advice about a specific production incident. OpsecForge cannot provide those.

What to expect

There is no support staff and no guaranteed response time. Messages are read and answered as the operator's time allows; security reports are looked at before general feedback. Not every message will receive a reply.

Reporting a vulnerability

This applies to the OpsecForge website and to the code in the public repository, including the opsecforge-mcp package.

  1. Email admin@opsecforge.com with the subject Vulnerability Disclosure. Please do not open a public issue for something that could be exploited.
  2. Describe the affected URL or package version, the steps to reproduce, and the impact you believe it has. Use synthetic data in any proof of concept.
  3. Test only against your own browser or local copy of the code. Do not access other people's data, degrade the service, or run automated scanning that generates heavy traffic.
  4. Allow reasonable time to investigate and fix before you disclose publicly. Fixes to published content or tools are listed on the corrections page.

OpsecForge does not offer a paid bounty. A machine-readable version of this policy is at /.well-known/security.txt.