Report suspected vulnerabilities to security@opencommercegraph.com. Do not file public issues for exploitable bugs.
- No package submits Solana transactions.
- Schema and validator packages run offline by default.
- No token, governance token, rewards token, or tokenomics code is allowed.
- Private keys, seed phrase patterns, and strict payment PII are scanner-blocked.
- The site is a static export served with HSTS, nosniff, frame controls, and a strict static-host CSP.
The demo uses fictional records and devnet-only flows. Never submit real merchant PII to demo fixtures.