Security

Please report vulnerabilities privately before public disclosure. This page is the standalone security policy for the project.

Report a vulnerability

Email sachncs@gmail.com with the affected version, impact, reproduction steps, and any proof of concept. Do not open a public issue for an undisclosed vulnerability.

You should receive an acknowledgement within 72 hours. If you do not, follow up on the same thread.

What to include

• A concise impact statement and affected component.
• Minimal reproduction steps or a test case.
• Whether the issue requires network access, the optional backend, or special transaction data.
• A suggested mitigation if you have one.

Security boundaries

• The default curve backend is pure Python and does not make network calls.
• Blockchain providers are opt-in and enforce URL, timeout, response-size, and transaction-ID validation.
• Dependency audits run in CI and release validation.
• The project is not a custody system, wallet, or guarantee of private-key safety; review signing and recovery workflows before using them with sensitive material.

Supported versions