If you discover a security vulnerability in pyrxd, please report it privately rather than filing a public GitHub issue.

Send disclosure to: security@mudwoodlabs.com

Include:

• A description of the issue and its impact
• Reproduction steps or a proof-of-concept
• Affected versions of pyrxd (and Python, if relevant)
• Your name / handle for credit (optional — anonymous reports accepted)

We aim to:

• Acknowledge receipt within 2 business days
• Provide an initial assessment within 7 business days
• Coordinate a fix and disclosure timeline based on severity, typically within 90 days following Google Project Zero norms

We will publicly credit reporters in the changelog and security advisories unless you request otherwise.

Our internal handling steps — triage, private fix, coordinated disclosure, and release — are documented in docs/runbooks/incident-response.md.

Security reports are welcome on:

• Cryptographic primitives in pyrxd.curve, pyrxd.security, pyrxd.aes_cbc, pyrxd.crypto
• Key derivation in pyrxd.hd (BIP32/39/44)
• Transaction construction and signing in pyrxd.transaction, pyrxd.script
• Glyph token protocol handling in pyrxd.glyph
• Gravity Protocol covenant code in pyrxd.gravity
• Network code in pyrxd.network (ElectrumX client)

Out of scope:

• Vulnerabilities in dependencies (please report to the upstream project)
• Social-engineering attacks against pyrxd users or maintainers
• Issues requiring physical access to a victim's device
• Issues already documented in the public CHANGELOG or issue tracker

We support security research conducted in good faith and will not pursue or support legal action against researchers who:

• Make a good-faith effort to avoid privacy violations, data destruction, and service disruption while testing;
• Test only against their own wallets, keys, and testnet/regtest deployments — never against another user's funds or a third party's infrastructure;
• Do not exploit a finding beyond the minimum needed to demonstrate it, and do not exfiltrate, retain, or publicly disclose others' data;
• Report privately (see above) and give us reasonable time to remediate before any public disclosure.

This is authorization to test within those bounds — not a paid bug bounty. pyrxd is a volunteer-maintained, pre-1.0, open-source project; there is no monetary reward at this time. We credit researchers in this file and the changelog with their consent. If demonstrating a finding would require moving real value, describe the mechanism instead — never put anyone's funds at risk.

pyrxd is pre-1.0 software. The cryptographic primitives have not been independently audited. Use at your own risk for production deployments. The library is in active development; APIs may change between minor versions before 1.0.

If you are deploying pyrxd in a production system handling real funds:

• Pin to a specific commit SHA in your pyproject.toml / requirements
• Run integration tests against a regtest or testnet network before any mainnet broadcast
• Hold private keys outside the web tier — see the architectural pattern in our README under "Production Architecture"
• Subscribe to GitHub Security Advisories for this repository

pyrxd is pre-1.0: the API and on-chain formats may change between minors, and security fixes land on the latest minor only. Security-relevant fixes have already shipped across recent minors (e.g. the HTLC preimage-length pin in 0.8.0), so running an older release means running known-unfixed code — upgrade to receive them.

Once we reach 1.0, the policy will move to a published support window covering at least the current major and the most recent minor of the prior major.