EthCC executes untrusted input (blocks, transactions, witnesses). Consensus differences, crashes, hangs or memory-safety bugs reachable from that input are security issues.

Please do not open a public issue for a vulnerability. Report it privately through GitHub's Report a vulnerability button on the repository's Security tab. Include the input that triggers it and the observed behaviour.

You can expect an acknowledgement within 72 hours. We will agree on a disclosure timeline with you; please keep details private until a fix is released.

• src/ and the tools that process untrusted data (poc-exec).
• Vendored libraries in deps/ are in scope when the issue is in how EthCC uses them; issues inside them should also be reported upstream.

EthCC is pre-1.0 and not yet a complete node. Do not use it to secure funds or as your only source of truth for chain state.