The Bitcoin Stamps indexer is consensus-critical infrastructure: a divergence in the rolling consensus hashes (txlist_hash / ledger_hash / messages_hash) can fork the view of the protocol across nodes. We take security and consensus reports seriously.

Security and consensus fixes target the active development line and the most recent release series. Older releases are not maintained.

Do not open a public issue for security, consensus, or supply-chain problems.

Report privately via GitHub Security Advisories:

➡️ https://github.com/stampchain-io/btc_stamps/security/advisories/new

• Consensus divergence — any input that causes the indexer to produce a different txlist_hash / ledger_hash / messages_hash than the reference/checkpoints, or any way to make nodes disagree.
• Supply-chain — compromised or tampered dependencies, build/release pipeline issues, or drift in consensus-critical pinned packages (e.g. regex / PyNaCl / pybase64).
• Memory-safety, RCE, injection, credential exposure, or denial-of-service in the indexer or its tooling.

• We aim to acknowledge a report within 3 business days.
• We will work with you on a fix and a coordinated disclosure timeline, and will credit reporters who wish to be named.

Please give us a reasonable opportunity to remediate before any public disclosure.