Do not open a public issue for security vulnerabilities.

Report security vulnerabilities by email to m0wer [at] sgn [dot] space, encrypted with the PGP key below.

Fingerprint: 1C53A412D11EF3051704419C44912E1E03005B31

The full public key is available in the repository at signatures/pubkeys/1C53A412D11EF3051704419C44912E1E03005B31.asc.

A useful report covers:

• a description of the vulnerability and its impact
• steps to reproduce or a proof-of-concept
• affected versions or components
• any suggested mitigations

1. Acknowledgment within a few days.
2. Coordinated disclosure: a fix will be prepared before public disclosure.
3. You will be credited in the release notes unless you prefer otherwise.

We may offer bounties paid in Bitcoin for critical vulnerabilities, but cannot make firm commitments due to budget constraints. Severity and impact determine eligibility on a case-by-case basis.