Trust it

Security policy

Report a flaw privately through GitHub, acknowledged within 72 hours, and what is in scope.

In this chapter

1. 01Reporting a vulnerabilityDo not open a public issue for anything that affects key material, signing, or the verification system.
2. 02What is in scopeAnything that breaks an invariant in docs/THREAT-MODEL.md. The ones we care about most.
3. 03What is out of scopeThe Out of scope section of the threat model is the authoritative list, and it is deliberately long. In particular, reports that amount to "there is no secure element" or "a...
4. 04Supported versionsnullroute is pre-1.0 and only the current release is supported. Until 1.0, treat every release as experimental and do not put material funds on it.
5. 05DisclosureWe prefer coordinated disclosure. Tell us first, give us a reasonable window to ship a fix, and we will credit you in the advisory unless you would rather we did not.

Rendered from SECURITY.md, the same bytes that ship with the code. SHA-256 119c52ece4613d86fce8da06762be2b118d2363f43d3affc3f07253fb02e1111