Reporting a vulnerability

Do not open a public issue for anything that affects key material, signing, or the verification system.

Report privately through GitHub's private vulnerability reporting on Xaxis/nullroute.

Please include:

• what an attacker gains, in concrete terms
• the steps to reproduce, ideally as a failing test
• which invariant it breaks, if you can identify one (see docs/THREAT-MODEL.md)
• the manifest root hash of the build you tested, if it is a released build

We will acknowledge within 72 hours and aim to have an assessment within seven days. If a fix requires changing a spec or an invariant, the advisory will say so, because a silent invariant change would defeat the point of having them.