# Security policy

## Reporting a vulnerability

Report vulnerabilities privately as a [confidential issue](https://docs.gitlab.com/user/project/issues/confidential_issues/) on [gitlab.com/invincible-privacy/joinstr](https://gitlab.com/invincible-privacy/joinstr/-/issues/new). Mark the issue confidential before you submit it, so only maintainers can see it.

Please include the affected version, the steps to reproduce and the impact you expect. A proof of concept helps.

Do not open a public issue, post on the forum or test against other people's pools until the problem is fixed.

## Scope

The [hall of fame](https://hof.joinstr.xyz) covers the Electrum plugin, the `plugin/` directory of [invincible-privacy/joinstr](https://gitlab.com/invincible-privacy/joinstr/-/tree/main/plugin). Reports on other clients are welcome through the same channel or the issue tracker of that client.

There is no bug bounty. Researchers who report valid vulnerabilities in the plugin are credited in the [hall of fame](https://hof.joinstr.xyz).

## Verifying releases

Electrum plugin, Android and Sparrow releases are signed with the PGP key `9253062A4F92D63459085CA62D230520212A5901`. Each [client page](../clients/index.md#release-signing) shows how to verify a download.