Process · Security
Security policy
OptionsSchema is a data specification, not a live service — but reference implementations and the registry API run on our infrastructure. Report vulnerabilities responsibly.
Report a vulnerability
- Email security@rebeltrade.com
- Please include: reproduction steps, affected endpoint or schema, and impact.
- Do not open a public issue for suspected vulnerabilities.
Disclosure window
We acknowledge reports within 3 business days and target a fix within 90 days. Coordinated public disclosure follows the fix ship date.
Scope
- *.rebeltrade.com/options-schema/* pages
- The registry API and badge endpoints
- Reference adapters in src/lib/options-schema-adapters.ts
Out of scope: broker infrastructure, third-party data providers, downstream consumers.
security.txt
Machine-readable copy at /.well-known/security.txt.