Do NOT open public issues for security vulnerabilities.
Report via:
- GPG-encrypted email to key in
keys/security.asc(preferred) - GitHub Security Advisory (private, via Security tab)
Include: description, affected component, reproduction steps, severity assessment.
| Severity | Definition | Target |
|---|---|---|
| Critical | Deanonymizes users, exposes IPs, compromises keys | 7 days |
| High | Breaks economic layer, degrades anonymity set | 30 days |
| Medium | DoS, non-privacy leaks | 90 days |
| Low | Everything else | Best effort |
Coordinated disclosure: fix first, disclose after. Reporter credited (or anonymous, by preference).