If you discover a security or privacy vulnerability, please report it privately by email:
You can email to request an encrypted Signal group.
In the email or in the Signal group, include as much info as you can:
- a description of the vulnerability
- the affected packages and commit
- reproduction steps or a proof of concept
Certain things are considered non-issues or out of scope. These include most actions by hostile nodes or impacts caused by network compromise. If there is a clear solution to mitigate the potential harms of malicious actors on the network, these can be implemented, but this repo does not claim to provide comprehensive protections against these types of threats.
Please do not suggest things like hardcoding maximum fees or block sizes for networks that do not have such limits. We cannot predict market conditions.