Security policy¶
Reporting a vulnerability¶
Report vulnerabilities privately as a confidential issue on gitlab.com/invincible-privacy/joinstr. Mark the issue confidential before you submit it, so only maintainers can see it.
Please include the affected version, the steps to reproduce and the impact you expect. A proof of concept helps.
Do not open a public issue, post on the forum or test against other people's pools until the problem is fixed.
Scope¶
The hall of fame covers the Electrum plugin, the plugin/ directory of invincible-privacy/joinstr. Reports on other clients are welcome through the same channel or the issue tracker of that client.
There is no bug bounty. Researchers who report valid vulnerabilities in the plugin are credited in the hall of fame.
Verifying releases¶
Electrum plugin, Android and Sparrow releases are signed with the PGP key 9253062A4F92D63459085CA62D230520212A5901. Each client page shows how to verify a download.