Security fixes are published for the current mainnet release line. Node operators and wallet users should run its latest patch release.

Please report suspected vulnerabilities privately to dev@parano1d.org. Do not open a public issue or discuss an unpatched vulnerability in a public channel.

Include the affected release or commit, component, platform, expected and observed behavior, security impact, and a minimal reproducer when possible. Reports concerning consensus, proof verification, wallet authorization or secret handling, synchronization, peer-to-peer networking, RPC boundaries, or release artifacts are especially important.

We will confirm receipt, assess the report, and coordinate remediation and disclosure with the reporter.

Parano1d does not currently operate a formal bug bounty. Receipt of a report does not imply compensation.